Changes

fix: skip kubectl client/server validation (#4530)

## Summary
- auto-generate in-cluster kubeconfig from service account token/CA when
no kubeconfig context exists in prow job pod
- always run kubectl --dry-run=client and --dry-run=server with strict
validation in .ci/verify-k8s-pod-yaml.sh
- update pod-prow_debug pod yaml so this PR triggers
pull-verify-k8s-pod-yaml for end-to-end verification
- sync CI guide doc for the new behavior

## Validation
- sh -n .ci/verify-k8s-pod-yaml.sh
- mock kubectl run confirms config
set-cluster/set-credentials/set-context and both apply
--dry-run=client/server are invoked
 (commit: 65b62be)