Add K8s tenant isolation coverage and threat model documentation

[bill-ph]

Summary

• add K8s end-to-end tests that verify tenant writes stay within their own object-store prefixes
• add a K8s test that verifies worker pods do not mount ambient service account tokens
• update MinIO test helpers to count objects via mc ls --recursive and add prefix stability checks

Testing

• Not run (not requested)