Make kubelet client optional for cluster-scoped brokers

[matheuscscp]

Part of: #7116

For a Deployment-based SPIRE agent serving only the Broker API via TCP, it makes no sense at all to configure the kubelet client. No Brokers should expect locality optimization from such a SPIRE agent deployment. This PR makes configuring the kubelet client optional for such deployments, by allowing Brokers with pod_reference_scope = "cluster" to ignore the kubelet client if not configured and attempt using the API server client.

[Copilot]

Pull request overview

This PR updates the Kubernetes workload attestor’s Broker API pod resolution so that cluster-scoped broker references can succeed even when the kubelet client is not configured/available, falling back to the Kubernetes API server as needed. This supports Deployment-based SPIRE agents that serve only the Broker API over TCP (per #7116) where kubelet locality optimizations are not applicable.

Changes:

• Added getPodListForReference(...) to make kubelet pod-list usage conditional on pod_reference_scope, allowing cluster-scope fallbacks when the kubelet client is missing or errors.
• Expanded test coverage for cluster-scope fallback behavior (including kubelet failures and absent kubelet client) and for agent-node scope requiring a kubelet client.
• Updated documentation and the full agent config reference to reflect the new fallback/requirement behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
pkg/agent/plugin/workloadattestor/k8s/k8s.go	Makes kubelet pod-list lookup optional for pod_reference_scope="cluster" via a helper that gates kubelet usage and supports API server fallback.
pkg/agent/plugin/workloadattestor/k8s/k8s_test.go	Adds tests covering fallback to API server when kubelet fails or is not configured (cluster scope) and enforcing kubelet requirement (agent-node scope).
doc/plugin_agent_workloadattestor_k8s.md	Documents that cluster scope can resolve without kubelet and that agent-node scope requires kubelet.
conf/agent/agent_full.conf	Updates reference config comments to describe kubelet requirement vs fallback behavior by scope.