feat: add legacy sidecar support for pre-1.28 Kubernetes clusters

[miyunari]

Summary

• Adds automatic Kubernetes version detection to determine native sidecar support (1.28+)
• On pre-1.28 clusters with continuous validation enabled, falls back to injecting a one-shot init container (initial validation) plus a traditional sidecar container (periodic re-validation) instead of using native sidecars
• Adds --skip-initial flag to validation-agent so the legacy sidecar skips redundant initial validation already performed by the init container

Changes

File	Change
internal/webhooks/version.go	New — NativeSidecarSupport() queries K8s API server version
internal/webhooks/pod_webhook.go	NewPodInterceptor accepts nativeSidecarSupport bool; new buildLegacySidecarContainer; idempotency check covers both init and regular containers
cmd/validation-agent/main.go	Added --skip-initial flag
cmd/main.go	Detects native sidecar support at startup, passes to webhook
internal/constants/images.go	Added ModelValidationSidecarContainerName constant
api/v1alpha1/modelvalidation_types.go	Updated ContinuousValidation docs
internal/webhooks/pod_webhook_legacy_test.go	New — tests for legacy sidecar path

Test plan

• All existing unit tests pass (make test)
• New tests cover legacy sidecar build functions, idempotency, and annotation tracking
• Manual test on a pre-1.28 Kind cluster with continuous validation enabled
• Manual test on a 1.29+ cluster to verify native sidecar path is unchanged

🤖 Generated with Claude Code