fix: a kubelet read is bounded, and one node's silence costs one node (ADR 0045)

[kfeofantov]

The two kubelet reads (/stats/summary, /metrics/cadvisor) had no deadline
and no size limit, and the nodes were read one after another in the goroutine
that also runs the snapshot flush. A kubelet that accepts the connection and
then goes quiet held the entire poll: client-go bounds the dial and the TLS
handshake, not the response, and the API server proxies silence as readily as
data.

• Deadline of 10 s per read, per path — the two fail independently and are
  already counted independently.
• Size limits, and passing one is a failed read rather than a short one:
  8 MiB for the summary (unmarshalled from a buffer, up to 8 in flight) and
  64 MiB for the exposition (decoded off the wire). A truncated response is a
  valid smaller response — a node that appears to run fewer containers.
• Eight nodes read at once, reading only. Ingestion stays in the polling
  goroutine, so the accumulator and the counter baselines keep one owner and no
  mutex.
• The client's rate limit is stated (50 QPS / burst 100). client-go's
  default of 5 QPS is already less than one poll of a 75-node cluster needs, and
  the limiter waits inside the request's own context — the deadline above would
  have fired on our own throttling.

Measured on kind 1.36.1, one node, by adding 40 pause pods to a 9-pod node:

pods	/stats/summary	/metrics/cadvisor
9	44,367 B	687,903 B
49	167,654 B	3,076,138 B

~3.1 KB and ~60 KB per pod; at the kubelet's 110-pod ceiling that is ~355 KB and
~6.7 MB. The limits are ~23× and ~10× those.

Each guard was checked by making it fail:

--- FAIL: TestASilentKubeletDoesNotHoldThePollForever (10.00s)
    pollOnce is still waiting on a silent kubelet; the read has no deadline
--- FAIL: TestOneUnresponsiveNodeCostsOneNodeNotTheCluster (2.41s)
    the poll took 2.412288208s, over 1.2s: the hung nodes were read one after another
    io.LimitReader: err=<nil> samples=1 (a plain limit is a clean end of input)

Nothing collected, stored or transmitted changes, so docs/security.md is
untouched; the reasoning is in ADR 0045, which amends ADR 0006 §1.

go build ./..., go test -race -count=1 ./..., make lint (0 issues),
go vet -tags e2e ./..., gofmt — all green.

🤖 Generated with Claude Code