[FEATURE] Add Sizing Contract for --component based sizing (kustomize) #3168

Defines which sizing fields exist, where they are set, and how a field is left to another owner such as a HorizontalPodAutoscaler.

Owner: sizing workstream (#3165). Consumers: kustomize release workstream (#3169), Helm workstream (#3170), GKE workstream (ai-on-gke/substrate-gke#70).

Spec:

• Fields: spec.replicas (not for the DaemonSet), each listed container's resources, and the PodDisruptionBudget's minAvailable or maxUnavailable.
• Base manifests set none of these fields.
  • components/sizing-default sets today's values
  • components/sizing-large replaces the large-cluster profile.
  • Operators may provide a custom size configuration and use that as a --component parameter.
• Unmanaged fields. A field that no applied sizing input sets is not rendered, so another manager can own it. Proposed: replicas and resources may be unmanaged; disruption budgets are always set by the install.

Workloads

• Helm values shape, under the stage charts and passed through by the install chart: apiServer, idpServer, controller, atelet, router, egress, podcertController, postgres, each with replicas (not atelet), resources per container, and pdb where a budget exists. null means the chart does not render the field. A values-large.yaml matches sizing-large ([FEATURE] Helm sizing values #3692).
• Immutable fields. Postgres storage size and StorageClass are fixed once the StatefulSet exists, and installs refuse to change them ([FEATURE] Refuse Postgres storage size or class changes the cluster cannot apply #3691).
• Ownership hand-off. Moving a field to another owner follows the Kubernetes server-side apply "transferring ownership" procedure: apply the field at its live value under a temporary manager, then stop setting it. ate-setup release-field automates it ([FEATURE] ate-setup release-field hands a field to another owner #3690).

Stability. Changing a default value in sizing-default or sizing-large needs a release note, because running clusters change on upgrade.

Enforcement

• Render tests: default output equals today's values, and --cluster-size=size10 output equals today's large profile.
• A kind upgrade test proves custom sizing and an autoscaler-owned replica count survive ([FEATURE] CI proves custom sizing survives upgrades #3694).

Related: #2579 (request), PR #3179 (implementation), PR #3030 (adds a size100 Go profile, which conflicts with moving profiles into Components).

Parent Issue: #3160