fix: exclude kubernetes==36.0.0 which breaks EKS auth and relax pyyam…

[aviruthen]

…l pin

What's changing and why?

kubernetes==36.0.0 has a bug where it loads exec-based authentication
tokens (from aws eks get-token) into its configuration but fails to
include the Authorization header in HTTP requests to the Kubernetes API
server, resulting in 401 Unauthorized errors.

This was fixed in kubernetes==36.0.1, which requires pyyaml>=6.0.3.
Relaxing the pyyaml pin from ==6.0.2 to >=6.0.2 allows pip to resolve
kubernetes>=36.0.1 instead of falling back to the broken 36.0.0.

Additionally, explicitly exclude kubernetes==36.0.0 to prevent it from
being installed even if other dependency constraints would allow it.

Before/After UX

Before:

After:

How was this change tested?

I ran multiple CodeBuilds verifying that tests were failing with kubernetes==36.0.0 and passign with kubernetes==36.0.1. I also verified locally that relaxing the pyyaml constraint allows kubernetes to be resolved to a higher version than 36.0.0 (e.g. 36.0.1)

Are unit tests added?

Are integration tests added?

Reviewer Guidelines

‼️ Merge Requirements: PRs with failing integration tests cannot be merged without justification.

One of the following must be true:

• All automated PR checks pass
• Failed tests include local run results/screenshots proving they work
• Changes are documentation-only