fix(agones): make the kind gate's Agones lifecycle actually work

Several independent causes, all of which had to be right before the
Fleet could reach Ready.

The supervisor pointed --sdk-base-url at 127.0.0.1:9357, which is the
Agones sidecar's gRPC port; its HTTP surface is 9358, and that is what
AGONES_SDK_HTTP_PORT carries and what agones_sdk.gd reads. An HTTP
client against the gRPC port could never have worked, in kind or in
production.

The supervisor also treated the sidecar's first incomplete /gameserver
response as fatal. The sidecar accepts requests before the controller
populates status.address and status.ports, so this produced a restart
loop precisely during normal Agones startup. It now polls until the
endpoint is assigned or ReadyTimeout elapses.

server_boot.gd started ServerControl and the Agones SDK only under
--allocated-mode, but the kind smoke deliberately strips that flag, so
nothing served the readiness probe and the GameServer could never become
Ready. Lifecycle now keys on AGONES_SDK_HTTP_PORT, which Agones injects
into every managed container, while allocation and roster semantics stay
tied to --allocated-mode. The SDK node is added to the tree
non-deferred, since start_health() creates a Timer immediately.

Fleet: Agones assigns its own SDK service account and masks that token
from the game container while keeping it for the injected sidecar, so
the manifest must not pin serviceAccountName or
automountServiceAccountToken. Godot stores user:// under HOME, so HOME
points at the writable runtime volume to keep the root filesystem
read-only, and fsGroup makes that volume writable for the non-root user.

Namespace: Agones' Dynamic port policy injects a hostPort, which both
the baseline and restricted Pod Security Standards forbid, so the
workload namespace enforces privileged while continuing to audit and
warn against restricted.

NetworkPolicy: the injected sidecar reaches the Kubernetes API over
HTTPS, and NetworkPolicy applies to the whole Pod rather than to the
container whose token was masked.

The kind runner creates the namespace before Helm so Agones can install
its per-namespace SDK RBAC, scopes gameservers.namespaces to it, forces
the allocator and ping Services to ClusterIP because LoadBalancer
ingress never becomes ready in plain kind, and labels the node so the
production Fleet's on-demand/zone constraints are exercised rather than
edited out of the rendered manifest.

Game/scripts/server_boot.gd

@@ -73,6 +73,29 @@ func _ready() -> void:
 		printerr("cosmic-clash-server: allocated transport '%s' is not supported by this build" % assigned_transport)
 		get_tree().quit(1)
 		return
+	# Agones injects its HTTP port into every managed game-server container.
+	# Keep lifecycle readiness and health active in the reduced kind smoke even
+	# though that environment intentionally omits allocation/roster semantics.
+	var agones_managed := not OS.get_environment("AGONES_SDK_HTTP_PORT").is_empty()
+	if allocated_mode or agones_managed:
+		_control = ServerControlScript.new()
+		_control.name = "ServerControl"
+		_control.drain_requested.connect(_on_drain_requested)
+		_control.initial_connect_ready.connect(_on_initial_connect_ready)
+		get_tree().root.add_child.call_deferred(_control)
+		var control_err := _control.start(int(config.get_value("readiness-port")), OS.get_environment(String(config.get_value("drain-token-env"))))
+		if control_err != OK:
+			printerr("cosmic-clash-server: refusing to start with invalid readiness control port")
+			get_tree().quit(1)
+			return
+	if agones_managed:
+		_agones = AgonesSDKScript.new()
+		_agones.name = "AgonesSDK"
+		# Health creates and starts a Timer immediately, so the SDK node must be
+		# in the tree before start_health() runs.
+		get_tree().root.add_child(_agones)
+		if _agones.configure_from_environment():
+			_agones.start_health()
 	if allocated_mode:
 		var roster_file := String(config.get_value("join-authorisations-file"))
 		var key_file := String(config.get_value("join-authorisations-key-file"))
@@ -88,25 +111,10 @@ func _ready() -> void:
 			printerr("cosmic-clash-server: refusing to start with invalid join-authorisations-file")
 			get_tree().quit(1)
 			return
-		_control = ServerControlScript.new()
 		# An allocated process owns exactly the roster issued for this match.
 		# Never let the general-purpose direct-server default (one player) start
 		# an allocated match with only a partial assignment admitted.
 		config.values["min-players"] = required_min_players(true, roster_tokens.size(), int(config.get_value("min-players")))
-		_control.name = "ServerControl"
-		_control.drain_requested.connect(_on_drain_requested)
-		_control.initial_connect_ready.connect(_on_initial_connect_ready)
-		get_tree().root.add_child.call_deferred(_control)
-		var control_err := _control.start(int(config.get_value("readiness-port")), OS.get_environment(String(config.get_value("drain-token-env"))))
-		if control_err != OK:
-			printerr("cosmic-clash-server: refusing to start with invalid readiness control port")
-			get_tree().quit(1)
-			return
-		_agones = AgonesSDKScript.new()
-		_agones.name = "AgonesSDK"
-		get_tree().root.add_child.call_deferred(_agones)
-		if _agones.configure_from_environment():
-			_agones.start_health()
 		_connection_leases = ConnectionLeaseClientScript.new()
 		_connection_leases.name = "ConnectionLeases"
 		var lease_url := OS.get_environment("COSMIC_CLASH_CONTROL_PLANE_URL")

Game/scripts/server_control.gd

@@ -1,9 +1,10 @@
 class_name ServerControl
 extends Node
 
-# Small loopback HTTP control surface for allocated servers. The Go supervisor
-# uses GET /ready as the explicit process-ready probe and POST /drain during a
-# controlled termination. Direct/community servers do not start this node.
+# Small loopback HTTP control surface for lifecycle-managed servers. The Go
+# supervisor uses GET /ready as the explicit process-ready probe and POST
+# /drain during a controlled termination. Direct/community servers outside
+# Agones do not start this node.
 
 signal drain_requested
 signal initial_connect_ready