[lkygithub]

Description

Consolidates a period of internal iteration.

Upgrade note: the Kubernetes DaemonSet workload carrier is removed. Tasks that
reference carrier type rlinf.io/kubernetes-daemonset no longer reconcile, and
the agent flag --task-daemonset-push-controller-workers no longer exists.
Recreate the affected workloads with the Deployment or StatefulSet carrier and
drop the flag from agent deployments before upgrading.

Highlights:

• Cluster lifecycle: new Delisted phase plus durable spec.delisted intent,
  so an operator can take a cluster out of scheduling without deleting it;
  spec.drainPreviousCordoned records the pre-drain cordon state so cancelling
  a drain restores the original intent instead of silently uncordoning.
  spec.agentNamespace is now validated as non-empty.
• Drain semantics: Tasks suspended by a cluster drain are marked with the
  rlark.io/drain-suspended annotation, so cancelling a drain only resumes the
  Tasks that the drain itself suspended, and a cluster stop is recorded through
  rlark.io/stopped.
• Data plane: the Ray DaemonSet carrier and its push controller are removed;
  the Ray head process now runs in blocking mode under the supervisor, and the
  workload SSH environment moves to port 2222 to avoid colliding with a host
  sshd inside the container image.
• Gateway: S3 storage configuration validation is normalized (endpoint, bucket
  and credential checks return structured errors), masked access key IDs are
  never echoed back on read, and StorageClass read access is opened to
  non-admin tenants while writes stay admin-only.
• Web UI: fixes across the Task request fan-out view, storage forms, tag
  filtering, node selection, popover/theme and dark-mode rendering, clipboard
  actions, and node statistics aggregation; new cluster administration screens
  for cordon, drain, stop and delist.
• Testing: a code-first Kind-based regression framework (kindtest) that
  provisions a local control plane and data plane, plus coverage aligning Job
  stop/start with the spec.suspended contract.
• Documentation updated in English and Chinese, including the agent
  configuration reference, architecture, concepts and runtime provider guide.

Motivation and Context

Source mapping:

• Previous synchronized internal tag: release-261023 (470a3d6ce9976654a2a5c9a8019d178e26540364)
• Internal source tag: release-261104 (c7478a2e20cede68123b17bc87f6ccf05eada047)
• Public base: main (6e9775ce83e53800022e5e9dfcfc2e96f3827269)
• Public candidate commit: 966cf020e84ce39245344e676d19432224d24ca2

How has this been tested?

• Commit Check and PR Title Check.
• Go lint for api, apps/embodied-runtime and apps/rlark.
• Frontend and documentation lint.
• Unit tests for the three Go modules.
• Generated-artifact verification (CRDs, clients and API reference).
• Docker builds for RLark, embodied-runtime and the web UI.
• Patch application and whitespace validation against the public base.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Documentation update
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.