Add Kustomize resolver preprocessor core

[whitemerch]

Tip

This PR is best reviewed commit by commit.

Summary

• add the Kustomize resolver core, including local-tree discovery, precheck diagnostics, helm prepass, and render orchestration
• add internal helper subprocess wiring (internal kustomize-render) and startup hook so kustomize builds run with timeout control
• add root-scoped file utilities and apply them in resolver paths to keep file access bounded while satisfying lint checks

Full design context and architecture details: #113

Test plan

• go test ./pkg/resolver/kustomize/... ./pkg/rootfile/... -count=1
• $(go env GOPATH)/bin/golangci-lint run ./pkg/resolver/kustomize/... ./pkg/rootfile/...

Notes

• this PR only includes preprocessor/resolver core changes
• detector mapping, scan activation, and fixtures are split into follow-up PRs

[datadog-prod-us1-4]

🎯 Code Coverage (details)
• Patch Coverage: 63.58%
• Overall Coverage: 47.02% (+1.49%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 601f8f4 | Docs | Datadog PR Page | Give us feedback!}