[FEAT cloudctl] - Add kubectl subcommand with version-pinned binary download #72

User Story

As a cloudctl user, I want cloudctl kubectl to automatically use the correct kubectl version for each cluster, so I never hit API compatibility issues.

Description

cloudctl kubectl <args> — detects the cluster's Kubernetes version via the existing cluster-version command, downloads the matching kubectl binary from dl.k8s.io into XDG cache, auto-injects --kubeconfig, --context, and --namespace from the active config, runs OIDC logon before exec. Handles plugin subcommand argument ordering and shell completion.

Acceptance Criteria

• Cluster version detected via cluster-version before download
• Correct kubectl binary downloaded and cached per version
• --kubeconfig, --context, --namespace injected unless explicitly provided by user
• OIDC logon performed before exec (skipped for token/exec-plugin auth)
• Plugin subcommand argument ordering preserved (plugin name before flags)
• __complete subcommand handled correctly (no interactive logon)

Reference Issues

Epic: #70