[FEATURE] ate-setup reports out-of-band changes before overwriting them #3689

ate-setup force-applies with server-side apply, so any kubectl scale, kubectl edit, or autoscaler change is reverted on the next deploy without notice. Report those fields before applying.

Tracks "Report out-of-band changes before overwriting them" in the Operator Supplied Values workstream of the Extensible Install Roadmap.

Current state (0b635b80): cmd/ate-setup/internal/kube/apply.go applies with Force: true and no dry run.

Required changes

• Before each apply, run a server-side dry-run apply without force.
• For every field another manager changed, report the object, field, live value, rendered value, and how to keep it.
• The first release only reports.
• Record the decision on whether later releases stop the deploy unless --allow-revert is given, and whether forced apply stays.

Dependencies: none. Foundation phase.

Breaking change: none in the report-only release. An enforcing mode would be breaking.

Enforcement: a kind test runs kubectl scale on a Deployment, redeploys, and asserts the report names the field.

Parent Issue: #3165