fix(kind): wait on the Fleet field that exists

The gate asserted `--for=jsonpath='{.status.ready}'=2`. An Agones Fleet's
status carries replicas, readyReplicas, reservedReplicas and
allocatedReplicas -- there is no `ready` -- so the wait could never match
however healthy the Fleet was.

It failed in the most misleading way available: as "the Fleet never
became ready", which sent three separate investigations after the game
server. Two of those found genuine bugs, but the gate would have stayed
red with both fixed.

The evidence is in the previous CI run's own dump, which the new
per-container diagnostics produced: both GameServers Ready and stable for
5m6s, and the Fleet reporting DESIRED 2 / CURRENT 2 / READY 2, while
kubectl wait timed out beside it. That same dump also confirms the health
fix in 0de97381 worked -- those GameServers had been churning every ~20s
before it.

Assert the corrected jsonpath in test_fleet_manifests.py and reject the
old one, alongside the build-by-default behaviour, so neither silently
regresses.

scripts/verify_kind_agones.sh

@@ -185,7 +185,13 @@ kubectl -n cosmic-clash create secret generic cosmic-clash-game-server \
 kubectl apply -f deploy/k8s/base/service-accounts.yaml
 kubectl apply -f "$work_dir/fleet.yaml"
 
-kubectl wait --for=jsonpath='{.status.ready}'=2 \
+# The field is readyReplicas, not ready: an Agones Fleet's status carries
+# replicas/readyReplicas/reservedReplicas/allocatedReplicas, and the READY
+# column printed by kubectl is readyReplicas. Waiting on `.status.ready` could
+# never match however healthy the Fleet was, which masked itself as "the Fleet
+# never became ready" and sent three separate investigations after the game
+# server instead of the assertion.
+kubectl wait --for=jsonpath='{.status.readyReplicas}'=2 \
   fleet/cosmic-clash-game -n cosmic-clash --timeout=5m
 
 cat > "$work_dir/allocation.yaml" <<'EOF'

server/security/test_fleet_manifests.py

@@ -111,6 +111,12 @@ class FleetManifestTest(unittest.TestCase):
             "agones.ping.udp.serviceType=ClusterIP",
         ):
             self.assertIn(service, runner)
+        # The Fleet's readiness field is readyReplicas; waiting on `.status.ready`
+        # silently never matches and reads as "the Fleet never became ready".
+        self.assertIn("jsonpath='{.status.readyReplicas}'=2", runner)
+        self.assertNotIn("jsonpath='{.status.ready}'", runner)
+        # Build by default, or a local rerun verifies whatever was tagged last.
+        self.assertIn("KIND_REUSE_GAME_SERVER_IMAGE", runner)
         self.assertIn("cosmic-clash.io/capacity-type=on-demand", runner)
         self.assertIn("topology.kubernetes.io/zone=kind-smoke", runner)
         self.assertIn("--control-plane-url=", runner)