ci: capture bounded pod failure diagnostics

[khalildai]

Summary

• replace unbounded/partial error-pod logging in the Cloud installer workflow with a shared diagnostic collector
• preserve current and last container state, exit code, image/imageID, bounded events, and bounded current/previous logs
• exclude pod environment, volumes, annotations, and Secret data; redact secret-shaped command arguments
• cap each failure surface at 10 abnormal pods, 10 containers per pod, 20 events, and 32 KiB per current/previous log

The readiness loops, timeouts, result outputs, and pass/fail decisions are unchanged.

Refs #791

Evidence

alpha.211 run 30972437222 and alpha.212 run 30981983923 each failed all three independent GitHub-hosted matrices with hermes-agent in RunContainerError / CrashLoopBackOff, but the existing workflow preserved only an empty current log. alpha.213 run 30984159719 later passed all three matrices naturally on the same workflow head.

Verification

• bash .github/utils/tests/test_collect_pod_diagnostics.sh
• bash -n .github/utils/collect_pod_diagnostics.sh .github/utils/tests/test_collect_pod_diagnostics.sh
• Ruby YAML parse for .github/workflows/cloud-e2e-installer.yml
• actionlint 1.7.12, excluding the pre-existing docker/login-action@v2 obsolete-version finding
• git diff --check

No E2E rerun, release, image/chart change, or cluster mutation was performed.