[FEATURE] Add an ate-setup render command #3240

Enable ate-setup to fully render a set of base kustomizations to a release artifact directory.

• images pinned to digests
• text placeholders replaced
• neutral defaults for every setting
• compatible with the --component flag
• takes in provider settings (e.g. token issuer, external database, transfer service account)
• Writes settings objects (ate-api-server-envvars, ate-api-config, ate-api-authentication, the env Secret) as manifests per [FEATURE] Establish cluster-side install setting records #3172

Consumers

• Release artifacts,
• Helm charts
• Provider CI.

Not in render output, by design: the key pools and the credential-provider namespace policy (bootstrap, #3175 / #3676) and bundled Postgres identities (#3184 / #3677). Neutral defaults depend on an explicit storage backend (#3668).

Implementation: PR #3411. Related: #3167 (render takes --component), #3176 and #3678 (release layout), #3170 (charts).

Enforcement. Render output feeds the release layout checks (#3678) and provider CI (ai-on-gke/substrate-gke#156).

Parent Issue: #3169