ci: lint Kubernetes manifests with Flint

.github/config/kube-linter.yaml

@@ -0,0 +1,10 @@
+checks:
+  # k8s/lgtm.yaml is intentionally a development and demo deployment. It follows the
+  # image's `latest` release, uses its default user and writable paths, and leaves resource
+  # sizing to the user.
+  exclude:
+    - latest-tag
+    - no-read-only-root-fs
+    - run-as-non-root
+    - unset-cpu-requirements
+    - unset-memory-requirements

.github/renovate-tracked-deps.json

@@ -327,6 +327,7 @@
         "google-java-format",
         "hadolint",
         "java",
+        "kube-linter",
         "lychee",
         "node",
         "npm:renovate",

mise.toml

@@ -19,6 +19,7 @@ editorconfig-checker = "3.8.0"
 golangci-lint = "2.12.2"
 google-java-format = "1.35.0"
 hadolint = "2.14.0"
+kube-linter = "0.8.3"
 lychee = "0.24.2"
 # @yarnpkg/libzip 3.2.2 is npm-signed and matches Yarn's release commit, but
 # was published without provenance; mise's no-downgrade policy otherwise rejects Renovate.