fix(cluster): bootstrap waits for the k3s API instead of trusting the installer exit

[incognick]

The bug

Dogfooding burrow cluster bootstrap on a DigitalOcean droplet surfaced a false failure. The upstream k3s installer ends with systemctl start k3s. On a small VPS, k3s's FIRST start is slow (image unpack, sqlite/etcd init) and exceeds systemd's start-notify timeout, so systemctl start returns non-zero — even though k3s comes up fine ~30-60s later (the journal shows the normal "Waiting for caches to sync" / "Storage is ready for all registered resources" startup). The installer therefore exited non-zero and bootstrap treated that as fatal (installing k3s: exit status 1), aborting before it deployed burrowd or printed the join token.

The fix

Make the k3s API answering — not the installer's exit code — bootstrap's success criterion.

• After running the installer, ensureK3sInstalled holds any non-zero exit rather than returning it, then polls the k3s API for readiness with a generous, configurable budget (default 4m, --k3s-api-timeout), well past a slow first-start.
• If the API answers within the budget, bootstrap proceeds. A non-zero installer exit is logged as a warning ("the k3s installer reported a non-zero exit (a slow first-start can time out systemd's readiness wait); the k3s API came up, continuing").
• bootstrap fails only if the API never answers within the budget, and that error carries the installer's exit and points at journalctl -xeu k3s.service and systemctl status k3s for diagnosis.
• The idempotent skip for an already-running k3s is unchanged.

The readiness budget is threaded through the k3sInstaller seam (WaitForAPI(ctx, budget)), so unit tests substitute a fake installer and never sleep.

Tests

• TestEnsureK3sInstalledProceedsOnInstallerExitWhenAPIReady / TestBootstrapProceedsWhenInstallerExitsButAPIReady — the exact regression: installer exits non-zero but the API is ready, so bootstrap reaches the deploy step and prints the join token (no abort), logging the exit as a warning.
• TestEnsureK3sInstalledFailsWhenAPINeverReady / TestBootstrapFailsWhenAPINeverReady — the API never answers, so bootstrap fails with the journalctl/systemctl guidance and prints no join token.
• Installer succeeds + API ready, and already-running k3s skip, remain green.

Light gate (go build, go vet, gofmt -l, go test ./..., SPDX) passes.