Infra audit: add single-GPU routing and best-fit worker packing

[luke-lombardi]

Summary

Adds release-ready Beta9 source changes for the guarded cost-reduction rollout:

• singleGpuNodeSelector support for worker-pool job specs
• cloned selectors with the one-GPU overlay only when gpuCount == 1, for local and provider jobs
• unchanged routing for two- and four-GPU requests
• opt-in worker.preferBestFit, defaulting to false
• least-free-worker-first selection only when enabled, with deterministic worker-ID ties
• tests for selector immutability, GPU counts, default behavior, priority, availability, packing, and ties

Release model

This PR does not create a cost-cut image or special gateway tag. After merge, it is released through the normal gateway-X.Y.Z workflow, which publishes the matching semver gateway image and OCI chart. A separate ordinary k8s-platform release PR can then bump the chart/image version. The Infra operator only verifies that exact normal release before enabling either feature through guarded configuration.

Safety boundary

Source only. No image was built or published, no workflow was dispatched, and no staging or production resource was changed.

Validation

• go test ./pkg/scheduler ./pkg/worker ./pkg/types -count=1
• touched Go files are gofmt clean
• git diff --check
• no release workflow files changed

Paired PRs

• beam-cloud/infra#213
• beam-cloud/k8s-platform#108