Integrate Kanon into agent config rendering

[kelos-bot]

What type of PR is this?

/kind feature

What this PR does / why we need it:

Bakes a pinned kanon binary into all five bundled agent images and adds a shared helper for applying controller-generated Kanon source config inside agent entrypoints.

The controller now emits KELOS_KANON_CONFIG from existing AgentConfig instructions and MCP servers while preserving the existing KELOS_AGENTS_MD, KELOS_MCP_SERVERS, and KELOS_PLUGIN_DIR env vars. The Codex and Claude Code entrypoints use Kanon for instructions and MCP rendering, then keep the existing plugin handling so current plugin paths and agent bundles do not change. Gemini, OpenCode, and Cursor keep the legacy rendering paths until Kanon has matching adapters.

Which issue(s) this PR is related to:

Fixes #1237

Special notes for your reviewer:

• No CRD or AgentConfig API fields are added.
• Kanon is pinned to 3edde4571b0aad2530627d94c8d2624ab44a3952 because the Kanon repository has no release tag yet.
• Verified with make test, make verify, git diff --check, and a smoke test that the shared helper applies config with the real Kanon binary for Codex and Claude.

Does this PR introduce a user-facing change?

Agent images now include Kanon, and Codex/Claude Code apply AgentConfig instructions and MCP servers through Kanon while preserving the existing AgentConfig environment variables.

---

Summary by cubic

Integrates kanon into all agent images and switches Codex and Claude Code to render AgentConfig instructions and MCP servers via Kanon, preserving existing env vars and plugin behavior. Improves consistency of config application without changing the AgentConfig API.

• New Features
  • Adds kanon to all bundled agent images and a shared apply_kanon_env_config helper.
  • Controller now emits KELOS_KANON_CONFIG built from AgentConfig instructions and MCP servers.
  • Codex and Claude Code apply instructions and MCP via Kanon; KELOS_PLUGIN_DIR handling remains unchanged.
  • Gemini, OpenCode, and Cursor keep legacy paths until Kanon adapters land.
  • Preserves KELOS_AGENTS_MD, KELOS_MCP_SERVERS, and KELOS_PLUGIN_DIR for compatibility.
  • Updates docs and tests; no CRD or AgentConfig API changes.

^{Written for commit 6ac4a1f. Summary will update on new commits.}

[kelos-bot]

/kelos review

[kelos-bot]

🤖 Kelos Task Status

Task kelos-reviewer-issue-comment-39a3df42d36d has failed. ❌