fix(bootstrap): surface diagnostics for K8s namespace not ready failures

[drew]

Summary

Users hitting "K8s namespace not ready" saw a bare error with zero recovery guidance, despite extensive diagnostic plumbing existing in the codebase. This PR closes three compounding gaps so that every failure path now surfaces actionable diagnosis.

Changes

Gap 1: Non-interactive path had no diagnosis at all

• deploy_gateway_with_panel non-interactive path (CI, piped output) used bare .await? propagation
• Now catches the error and runs the same diagnosis + fallback as the interactive path

Gap 2: Interactive path silently dropped unmatched failures

• diagnose_failure() returned None for the common timeout case (no pattern matched)
• generic_failure_diagnosis() existed but was never called — there was no else branch
• Now uses .unwrap_or_else(|| generic_failure_diagnosis(name)) so there's always guidance shown

Gap 3: Container logs were never passed to the diagnosis engine

• The call was diagnose_failure(name, &err_str, None) — always None
• Patterns like extension-apiserver-authentication, HEALTHCHECK_NODE_PRESSURE, no default route present could never match unless they appeared in the miette error chain
• Now fetches 80 lines of container logs via new fetch_gateway_logs() and passes them to the matcher

Additional fixes

• Timeout error path in wait_for_namespace now includes container logs (like the DNS and crash paths already did)
• Exec-error-on-final-attempt path now includes container logs and a descriptive message instead of a raw error
• generic_failure_diagnosis now suggests openshell doctor logs and openshell doctor check before the destroy-and-recreate step, making existing diagnostic tooling discoverable

Testing

• mise run pre-commit passes
• All existing unit tests pass (0 failures)
• E2E tests (requires running cluster)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)