feat(grafana): add Kubernetes 1621 and 747 curated packs

[shmsr]

Summary

• Stacked on fix: fail Grafana namespaced metric_map targets and cover field-profile ingest #439 (fix/field-profile-coverage-and-metric-map-prefix). 747's metric_map uses bare kube_pod_container_status_restarts → kube_pod_container_status_restarts_total; that fail-closed prefix check is why this cannot land on main first.
• Curated pack for Grafana 1621 (Kubernetes cluster monitoring via Prometheus / cAdvisor). Same title as 315, so registry detection is gnetId-only. Differentiator: Cluster Filesystem usage sums every cAdvisor device starting /dev/ (315's ^/dev/[sv]d[a-z][1-9]$ misses nvme). $Node is rewritten to canonical instance and populated from label_values(machine_cpu_cores, instance) as multi-select. Duplicate Used/Total tiles are renamed Memory/CPU/Filesystem; systemd stays an honest empty; obsolete docker/rkt series are dropped with approximation_note.
• Curated pack for Grafana 747 (Kubernetes Pod Metrics). Heapster pod_name / hostname → canonical pod / instance. Hidden $Pod_ip / $phase / $container markdown becomes a pod→IP datatable, pod→container datatable, and Running metric tile. Engine: text panels with a curated esql_query override continue translation instead of always early-returning markdown. $Pod + $Node are multi-select; panel ES|QL uses MV_CONTAINS and pod IS NOT NULL so the root cgroup cannot leak into pod KPIs. Grafana CPU Total (format=bytes, node-wide rate) is titled Node CPU with primary_format: short.
• Shared k8s_exporter now emits /dev/nvme0n1p1 plus pod_ip on kube_pod_info and kube_pod_container_info so both packs validate on the curated rig.

Test plan

• pytest tests/test_curated_packs.py -k "1621 or 747" (16 passed)
• Profile leakage tests/test_field_profile_portability.py -k "test_k8s_pack_no_profile_leakage and (1621 or 747)" (8 passed)
• scripts/run_cross_profile_corpus.py --input-dir /tmp/k8s-pack-corpus — OK
• live_validate --fail-on-bug: 1621 21/21 ok, 747 17/17 ok, 0 real bugs
• dashboards_api --fail-on-error: 21 and 18 mapped, 0 errors
• grafana-validate-uploaded --fail-on-runtime-errors: 0 runtime errors; 1621 has 2 expected empty systemd panels
• Render audit --fail-on-error: both pass
• Numeric ES|QL + Kibana UI vs exporter: 1621 FS 86/300 GB (nvme included); Node=node-1 → 5/16 GB memory, 40/150 GB FS; 747 all-pods memory 1.50 GB; Pod=web-0,web-1 → 376 MB and IPs 10.244.0.1 / .2

Fixes #401
Fixes #400