fix(python): exclude Kubernetes client 36.0.0

[stellan-lee]

Summary

• exclude Kubernetes client 36.0.0 from the Python SDK dependency range
• test the first fixed releases and the current 36.x release in compatibility CI
• verify the in-cluster integration pod has a fixed 36.x client before its authenticated API request
• document the excluded release and refresh the dependency regression assertion

Validation

• compatibility tests pass with 28.1.0, 36.0.1, 36.0.2, and 36.0.3
• dependency resolution rejects 36.0.0
• built wheel metadata contains kubernetes!=36.0.0,<37,>=28.1.0
• integration image resolves Kubernetes client 36.0.3 and passes the fixed-release assertion
• Dockerfile validation and workflow YAML parsing pass

Closes #8