(K8s 2/4) Refuse to resume expired suspended Kubernetes environments

What does this MR do?

Labels a suspended environment's PVC, and its per-job namespace, with the runner ID. A resume onto a PVC that is gone, being deleted, or past its stamped expiry fails with runtime_environment_unavailable.

Ownership is by runner ID only. The system ID check in prepareResume is dropped on purpose, so any manager of the registration can resume the environment, just as any of them can sweep it.

Why was this MR needed?

An expired environment must not be resumed. Nothing is deleted yet; the next MR adds the cleanup.

What's the best way to test this MR?

go test -race ./executors/kubernetes/ -run 'Resume|Suspend'

What are the relevant issue numbers?

Related to #39469. Depends on gitlab!262332 (merged).