CAPVCO v0.6.0

GPU workloads verified on real hardware, supported Kubernetes versions, and
automatic worker scaling.

- GPU workload tier (#34): a pod consuming a real NVIDIA L4, end to end. Root
  cause of the long-standing failure was the platform mapping the card's 32GiB
  BAR1 above the guest CPU's 40 physical address bits; every node image is now
  GPU-ready (pci=nocrs pci=realloc), and a real-GPU CI job keeps it proven.
- Supported Kubernetes versions (#28): v1.35.8 / v1.36.4 / v1.37.0. The shipped
  v1.30.14 and v1.31.5 were EOL by 14 and 10 months. Brings clusterctl v1.14.2,
  kind v0.33.0, cert-manager v1.21.1, and the provider now builds against
  cluster-api v1.14.2. Resolves #38.
- Automatic worker scaling (#24): cluster-autoscaler via the clusterapi
  provider, including scale to and from zero, backed by
  VCOMachineTemplate.status.capacity.

Validated on a real backend by 11 feature-matrix scenarios per merge request.

Known limitations unchanged and documented: RWO volumes are not single-node-safe
(#22) and encrypted volumes need cryptsetup in the CSI image (#32) — both
driver-side.