feat: federated events transport

[savme]

The exporter connects to NATS without TLS, so it cannot reach any listener requiring a client certificate - both the shared nats-system broker and the edge relay. It has only ever run in dev, where NATS has no TLS. Edge clusters also have no path to a central broker at all.

The exporter gains mTLS and publishes to a subject carrying a cluster token, so per-PoP NATS permissions can scope publish access to that cluster's own subjects. An activity nkey-generator subcommand mints per-cluster NKeys from Karmada cluster state and distributes them through ESO. A Kustomize bundle deploys the exporter alongside a local core-NATS relay on edge cells, and a second processor instance consumes the federated stream from the hub while publishing activities back to the shared broker.

Test plan

• go test
• Covers subject and grant derivation across prefixes, including that a cluster name containing a dot is rejected rather than silently widening a grant
• Covers that an unset output broker keeps the processor on a single connection
• Deploy to staging and confirm event_exporter_events_published_total emits its first series

Depends on #248

Stack:

• fix: shared processor event extractors #239
• feat: add federated events schema #240
• feat: add federated event Source/Resource/Origin support #245
• feat: add federated events exporter #246
• feat: qualify dedup IDs and bound the exporter queue #248
• feat: federated events transport #250 👈