feat: release pipeline, k3s manifests, infra k3s bootstrap

- scripts/release.sh: full release orchestration (build, publish, install)
- deploy/k3s/: Deployment, ConfigMap, PVC, Namespace with kustomize
  hostNetwork for dnsmasq, NET_ADMIN caps, local-path PVC
- Infra role gets /var/lib/rancher partition (20GB, preserved on reprovision)
  for k3s etcd data persistence across reinstalls
- Infra %post installs k3s server (INSTALL_K3S_SKIP_START=true)
- 5 new kickstart tests (27 total)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bastion/deploy/k3s/configmap.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: bastion-config
+  namespace: lab-infra
+data:
+  HTTP_PORT: "8080"
+  DOMAIN: "ad.itaz.eu"
+  FEDORA_VERSION: "43"
+  DHCP_MODE: "proxy"
+  TIMEZONE: "Europe/London"
+  LOCALE: "en_GB.UTF-8"