feat(runners): implement Tekton Pipeline runner with native metadata discovery

Implement the TektonPipeline runner with two-tier native metadata
discovery and all SupportedRunner interface methods.

Tier 1 (always available): reads HOSTNAME env var and ServiceAccount
namespace file from the pod filesystem.

Tier 2 (best-effort): queries the K8s API for pod labels with
tekton.dev/* prefix, providing rich pipeline context. Gracefully
degrades when RBAC is denied or SA token is missing.

Interface methods:
- RunURI: Tekton Dashboard URL when configured, tekton-pipeline://
  identifier URI as fallback
- Report: writes attestation summary to /tekton/results/ with
  3500-byte truncation for Tekton Results size limits
- Environment: detects GKE/EKS/AKS as Managed, plain K8s as
  SelfHosted
- ResolveEnvVars: synthesizes discovered metadata as key-value entries
- ListEnvVars: returns HOSTNAME as the only consumed env var

Includes 26 unit tests covering discovery success, RBAC denial,
missing SA token, all RunURI variants, Report truncation, Environment
detection, and ResolveEnvVars with full and minimal label sets.

Author: waveywaves

pkg/attestation/crafter/runner.go

@@ -96,8 +96,8 @@ var RunnerFactories = map[schemaapi.CraftingSchema_Runner_RunnerType]RunnerFacto
 	schemaapi.CraftingSchema_Runner_TEAMCITY_PIPELINE: func(_ string, _ *zerolog.Logger) SupportedRunner {
 		return runners.NewTeamCityPipeline()
 	},
-	schemaapi.CraftingSchema_Runner_TEKTON_PIPELINE: func(_ string, _ *zerolog.Logger) SupportedRunner {
-		return runners.NewTektonPipeline()
+	schemaapi.CraftingSchema_Runner_TEKTON_PIPELINE: func(_ string, logger *zerolog.Logger) SupportedRunner {
+		return runners.NewTektonPipeline(logger)
 	},
 }