Add --fake-data-plane to install a fake data plane for control-plane benchmarks - #2469

The fake data plane, fake-atelet and fake-workersync, lets a benchmark
drive ate-api-server and Postgres past what real nodes can restore.
ate-setup --fake-data-plane installs it in place of the real one, so
nothing has to be grafted onto a live install. A new fake-data-plane
kustomize component, layered over the atelet and ate-controller applies
the way cordon-control-plane is:

- runs fake-atelet in atelet's own DaemonSet, so it keeps atelet's
  name, service account, and node selector; fake-atelet writes snapshot
  placeholders in place of the objectstore-plugin sidecar, so it takes
  that sidecar's env, the storage settings each overlay gives it, and the
  patch drops atelet's args, host mounts, sidecar, and scrape
  annotations;
- scales ate-controller to zero, whose worker syncer would delete the
  fake Workers and whose WorkerPool controller would make real worker
  pods; its NetworkPolicy and egress MITM trust controllers stop too,
  which fake actors do not need;
- adds fake-workersync in ate-system, one at a time through the
  Recreate strategy, pinned with the control plane under
  --cordon-control-plane.

The installer only chooses the data plane; how slowly fake-atelet
answers is a benchmark parameter. fake-atelet reads each of its tuning
flags from a FAKE_ATELET_<FLAG> variable, a flag on the command line
winning, and the component loads those variables from an optional
fake-atelet-tuning ConfigMap that no install creates or resets.

Only deploy ate-system switches a cluster between the real and fake
data planes:

- deploy atelet and deploy ate-controller refuse a data plane other
  than the installed one, since each alone would switch only half of it;
- --fake-data-plane refuses a cluster with live worker pods, which
  would outlive ate-controller beside a fake atelet;
- a real install stops fake-workersync, and waits for its pod to go,
  before applying the bundle, so it never runs beside ate-controller,
  and deletes the rest of its manifest every time.

delete ate-system always deletes fake-workersync. Both fakes join
images.Components, so a pre-built install can use them.

fake-workersync places Workers on the nodes that run a fake-atelet pod
rather than on a node label, which would also match the tainted control
plane nodes under --cordon-control-plane. A node keeps its Workers for
--node-grace after its fake-atelet pod goes, so a DaemonSet rollout
does not move them. fake-workersync no longer deletes its Workers on
shutdown; it adopts them when it starts, retrying while ate-api-server
does not serve yet, and reports ready only once it has, so the
install's rollout wait covers it. Its relay identity moves to ate-system
with it.

kube.NewFromClients builds a Client on existing clients, so the step
tests can exercise the removal through fake typed and dynamic clients;
client-go's dynamic fake is vendored for them.