Add a fork-only end-to-end verify workflow (inflator + metadata images + tester)

[Maximilian-Nesslauer]

Goal

Prove the full KSA pipeline end to end with fork resources only, before the upstream PR: netkan inflation, the metadata tester, and instance fake installing a real KSA mod. This is the "demonstrably working" evidence for #37, and it is unblocked now that KSAModding/xKAN-meta_testing#2 and #34 are merged.

Background

The real validation workflows (KSAModding/KSA-NetKAN#2, KSAModding/KSA-CKAN-meta#4) run the kspckan/metadata image built from upstream KSP-CKAN/CKAN, which rejects --game KSA until the client merges there. But that image is built from THIS repo's metadata.Dockerfile, which pip-installs NetKAN-Infra and xKAN-meta_testing from upstream KSP-CKAN. So a fork build that redirects those two pip URLs to the KSAModding forks yields a KSA-capable image today.

Tasks

• Add a workflow_dispatch workflow (e.g. e2e-verify.yml) that:
  • builds netkan.exe/ckan.exe from this repo (or reuses build.yml),
  • builds the metadata image from metadata.Dockerfile with the two pip URLs pointed at KSAModding/NetKAN-Infra and KSAModding/xKAN-meta_testing (build arg or sed),
  • runs the tester with game: KSA against the netkans in KSAModding/KSA-NetKAN,
  • uploads the inflated ckans and logs as artifacts.
• Only GITHUB_TOKEN needed; no AWS/DockerHub secrets.
• Keep the workflow out of the upstream PR diff: park it on a dedicated branch (workflow_dispatch can run from any branch) or remove it before opening the PR.
• Record the green run in Prepare the upstream PR to KSP-CKAN/CKAN #37's evidence list.
• Watch for the shared-external-mod-root behavior when the tester installs more than one mod in a run (tracked separately in Verify tester behavior with KSA's shared external mod root xKAN-meta_testing#3).

Gate / sequencing

Unblocked now. The upstream-image gate only applies to the real KSA-NetKAN / KSA-CKAN-meta workflows, not to this fork-built variant.

Part of KSP-CKAN#4457.

[Maximilian-Nesslauer]

#44 works