Report missing Kind and control-plane prerequisites before deployment

[cloudonly]

On a new workstation, a Kind demo install reports only a missing kubeconfig context. On a cluster without the control plane, it can create the demo Namespace and WorkerPool before failing while waiting for a Deployment that no controller can create.

Check Docker and the resolved kubeconfig context before Kind deployments, with instructions to restore kubeconfig or create the cluster and local registry. Demo and benchmark commands check for deployment/ate-controller before creating resources. Permission and connection errors retain their original cause. The checks live in ate-setup, so both native commands and the shell shims use them, including when a demo flag precedes --deploy-ate-system.

The controller check establishes that it is installed; it does not replace workload rollout checks. Help and delete commands do not require the new deployment checks. Cluster recovery guidance states that the creation script replaces an existing cluster with the same name.

Fixes #2400.

Validation:

• Regression tests first failed on the original implementation. Tests cover native commands and Kind shims, missing context and Docker, demo and benchmark prerequisites, action order, installed controllers, Forbidden responses, resolved configuration, malformed kubeconfig, and help.
• go test -race ./cmd/ate-setup/... passed on macOS arm64.
• The original isolated reproduction passes with the fix; the missing-controller scenario makes no resource writes.
• make verify passed on Linux amd64 with Go 1.27.1: all 145 test packages passed with the race detector, and all 14 verification scripts passed.
• The Linux ate-setup binary built successfully from the final commit. Generated files and the Git working tree remained clean.