feat: add inventory apply for declarative population

[ecv]

What

Adds datumctl inventory apply -f FILE — an idempotent, declarative upsert of inventory objects for populating the inventory from declared config. The plugin half of replacing bin/load-inventory (#2).

Behavior

• Reads multi-doc YAML/JSON from -f files or stdin (-); decodes into typed objects (client-side validation; unsupported kinds rejected with a clear error).
• Applies in dependency order — provider → region → site → cluster → node — regardless of order in the file.
• Idempotent server-side apply (field manager datumctl-inventory); re-applying the same manifest makes no changes.
• --dry-run=server validates against the API without persisting.
• Population only — no fleet-management/lifecycle ops (assign/cordon/decommission/delete), per Native datumctl inventory apply to replace bin/load-inventory #2 scope.

Accepts Provider, Region, Site, Cluster, Node.

Verification

Unit tests: multi-doc parse, dependency ordering, unsupported-kind rejection, empty input, GVK-set-for-SSA.

Against prod (--dry-run=server, read-only — no writes): re-applied provider+region+site; confirmed dependency reordering (input site,provider,region → applied provider,region,site), SSA + webhook validation pass, stdin path works, unsupported-kind rejected:

applied provider/netactuate (server dry-run)
applied region/us-central-1 (server dry-run)
applied site/us-central-1a (server dry-run)

Remaining for #2 (separate, infra-side)

Collapse bin/load-inventory (datum-cloud/infra) into a renderer that pipes manifests to datumctl inventory apply -f -, retiring its hand-rolled datumctl apply plumbing. Not in this repo.