fix(taskruntime): fetch Workflow UID from apiserver (downward-API can't project it)

[bdchatham]

Summary

First manual fire of the new release-test Workflow on harbor (post sei-protocol/platform#627 merge) surfaced two real bugs in the seitask + scenario YAML contract. Both are fixed here.

Bug 1 (the one we hit): seitask: infra: downward-API env not projected: [SEI_WORKFLOW_NAME SEI_WORKFLOW_UID SEI_NAMESPACE]

`keygen-admin` Task pod exited at startup. Root cause: `taskruntime.LoadWorkflowIdentity` expected three env vars projected via Kubernetes downward API, but the release-test scenario YAML's Task containers had no env block.

Worse: when we tried to add the downward-API projections, we discovered chaos-mesh stamps `chaos-mesh.org/workflow=` label on Task pods but does NOT stamp the Workflow CR's UID anywhere. The taskruntime/ownerref.go comment claiming chaos-mesh writes the UID to an annotation was aspirational; the reality on a v2.8.0 Task pod is no UID label, no UID annotation.

Bug 2 (downstream): `provision-validator-chain` stuck in `CreateContainerConfigError`

The Task pod referenced `workflow-vars-` ConfigMap via envFrom; that CM is created by keygen-admin. Because keygen-admin failed, the CM never existed and the kubelet couldn't start the container. Resolves automatically once keygen-admin succeeds.

Fix

`taskruntime.LoadWorkflowIdentity` signature change — now `(ctx, client.Client)` instead of `()`. Reads NAME + NAMESPACE from env (downward-API projectable), then fetches the Workflow CR's UID from the apiserver using NAME + NAMESPACE. `SEI_WORKFLOW_UID` env still works as a short-circuit (tests rely on it).

Subcommand callers (keygen, provision-snd, upload-report) reorder client construction before identity loading.

`scenarios/release-test.yaml` — every seitask Task container projects:
```yaml
env:

• name: SEI_WORKFLOW_NAME
  valueFrom:
  fieldRef:
  fieldPath: metadata.labels['chaos-mesh.org/workflow']
• name: SEI_NAMESPACE
  valueFrom:
  fieldRef:
  fieldPath: metadata.namespace
  ```

UID flows from the apiserver lookup in LoadWorkflowIdentity.

Runner subcommand unaffected — it doesn't call LoadWorkflowIdentity (verified). `major-upgrade.yaml` therefore doesn't need a scenario YAML update.

Test plan

• `go test ./internal/taskruntime/...` passes including new apiserver-lookup test case (also covers workflow-not-found → Infra error, and env-UID short-circuit)
• `go test ./...` passes
• `golangci-lint run` clean
• `scenarios/release-test.yaml` validates via `kubectl apply --dry-run=server --validate=strict` against the chaos-mesh.org Workflow CRD on harbor
• After merge + image build + SCENARIO_REF bump in sei-protocol/platform's workflow.yaml: manually fire `release-test-workflow` CronJob and verify keygen-admin, provision-validator-chain, provision-rpc-fleet, run-release-test, upload-report all complete

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Changes how seitask discovers its parent Workflow identity by introducing an apiserver lookup and updating scenario env projections; failures here would break task startup/ownerRef stamping across workflows.

Overview
Fixes seitask startup/cleanup wiring by changing taskruntime.LoadWorkflowIdentity to take (ctx, client) and fetch the parent Workflow UID from the Kubernetes apiserver when SEI_WORKFLOW_UID is not provided (still supported as a short-circuit).

Updates keygen, provision-snd, and upload-report to build the kube client before loading workflow identity, adjusts tests accordingly, and updates scenarios/release-test.yaml so each seitask Task container projects SEI_WORKFLOW_NAME and SEI_NAMESPACE via downward API.

^{Reviewed by Cursor Bugbot for commit a605b8e. Bugbot is set up for automated code reviews on this repo. Configure here.}