feat(conformity): lint finds resource, version and listener rules no cluster can meet

[bmscomp]

PR 8c of the conformity pre-flight, and the last (plan D1: the core 21 checks). kates conformity lint's incoherence stage gains the last 9 checks, in rules_resources.go and rules_language.go. It uses the two-pass engine from #430 unchanged.

Errors

No cluster can pass these, so check stops with exit 2 before it calls the API. When a rule one of them reads is warn or waived, it becomes rule-never-passes instead.

Code	Fires when
request-above-limit	a role's cpu or memory request needs more than its limit allows, and count allows no fewer than 1 pod
strimzi-1-with-pre-kraft-kafka	versions.strimzi needs 1.0 or later, and versions.kafka allows nothing from 3.0 up
listener-contradicts-every	a required listener's type, tls or auth shares no value with kafka.listeners.every
listener-port-below-9092	a required listener's port allows nothing from 9092 up, the minimum in Strimzi's Kafka CRD

request-above-limit compares quantities exactly (big.Rat, restored from b60c2ee): 8Gi is above 8G, and 700m equals "0.7". Float64 would put 700m a hair above 0.7 and raise a false error, so this check needs the exact numbers that 8b could do without. TestQuantityEdges covers both cases.

Warnings

Code	Fires when
byte-quantity-too-small	a memory or storage size is above 0 and below 1Mi, such as 512m for 512Mi. A whole min that small is left alone as a deliberate "must be set"; a fractional one is flagged
ephemeral-single-node	storage.type allows only ephemeral, and count allows at most one node
podmonitor-without-metrics	podMonitor is required with metrics none, and no Kafka Exporter is required
authorization-without-authentication	the simple or Keycloak authorizer with every.auth: none (neither tolerated)
setting-without-effect	a custom zoneLabel with no zones, skew or rackAwareness rule, or source: brokers with no config or rackAwareness rule

Where this differs from the catalogue spec

• request-above-limit has only its error form. The warning for a count that allows 0 pods is left out.
• One message per check. Left out: the variants per field and per unit, apart from the "a trailing m means milli" hint.
• The rule-never-passes catalogue entry stays on zones-unreachable. Its trigger is shorter than the listener one in b60c2ee.

Tests

• TestCatalogue and TestEveryCatalogueRuleIsRegistered: each check fires on its trigger and not on its near miss, and the catalogue matches the registered checks both ways.
• kind-ci, minimal and prod-3az still lint clean.
• Run locally, all passing: go test ./..., go vet ./..., golangci-lint run --new-from-rev=origin/main ./..., govulncheck, check-cli-style.sh, check-cli-compat.sh, and the full kates ./mvnw test (1,489 tests, 0 failures).