[wip] start pulling kubernetes logic out of environmentd's kubernetes orchestrator into orchestratord

[doy-materialize]

Motivation

having two separate systems managing our kubernetes resources has been a pain. also, this is one prerequisite to moving to an environmentd-less world (since we probably don't want the balancers doing our kubernetes operations), and should also allow us to have better separation of permissions (since we will eventually be able to remove ~all kubernetes access from environmentd itself).

Tips for reviewer

this is very much a work in progress and not ready to merge - i've sketched out the shape of the implementation, but haven't tried using it yet. opening this now to get feedback on the overall direction - if this looks reasonable, if there are other things i should consider, etc.

Checklist

• This PR has adequate test coverage / QA involvement has been duly considered. (trigger-ci for additional test/nightly runs)
• This PR has an associated up-to-date design doc, is a design doc (template), or is sufficiently small to not require a design.
• If this PR evolves an existing $T ⇔ Proto$T mapping (possibly in a backwards-incompatible way), then it is tagged with a T-proto label.
• If this PR will require changes to cloud orchestration or tests, there is a companion cloud PR to account for those changes that is tagged with the release-blocker label (example).
• If this PR includes major user-facing behavior changes, I have pinged the relevant PM to schedule a changelog post.