feat: Kubernetes ConfigMap watcher — event-driven config reload

[nfvelten]

Summary

• Adds a kubernetes feature (on by default) that watches a named ConfigMap via the K8s API and hot-reloads Arbitus config on every Apply event — replacing the 30-second file polling loop with an event-driven reload
• Extracts shared reload logic into src/reload.rs (build_live_config, reload_from_yaml) used by both the file hot-reload loop and the new ConfigMap watcher
• Adds Config::from_yaml_str for parsing config from in-memory YAML (used by the watcher)
• Helm: kubernetesWatcher.enabled: true provisions the Role + RoleBinding and injects the kubernetes: config block automatically

Usage

# values.yaml
kubernetesWatcher:
  enabled: true
  # configMapName defaults to the release fullname
  # namespace defaults to the pod's own namespace
  key: "gateway.yml"

Or directly in gateway.yml:

kubernetes:
  configmap_name: my-arbitus-config
  namespace: ai-agents   # optional, auto-detected from SA token
  key: gateway.yml

Test plan

• cargo fmt --check passes
• cargo clippy -- -D warnings passes
• cargo test --lib — 419 tests pass
• Deploy to a K8s cluster with kubernetesWatcher.enabled: true, update the ConfigMap, verify the gateway reloads within seconds without a restart

Closes #132