Multi-account Kubernetes isolation

Kargo moves the promotion decision into a controller, and the gate is the part left blank

A dev.to writeup lays out per-account EKS clusters, digest-only promotion and OIDC everywhere. The metric-backed gate it calls critical is the thinnest part of the design.