fix: add kustomize binary

[cyberox]

Summary

Adds the kustomize binary to the Docker image so the existing kustomize input type actually works at runtime.

Motivation

Kapitan already ships a kustomize input type (kapitan/inputs/kustomize.py), but the Dockerfile only installed the cue binary in the go-builder stage. Any use of the kustomize input type inside the container would fail because the kustomize executable was missing from the final image.

Affected files or URLs

• Dockerfile — install sigs.k8s.io/kustomize/kustomize/v5 in the go-builder stage and copy the resulting binary to /usr/bin/kustomize in the final image.

Test plan

• make lint passes
• make format passes (or no formatting changes needed)
• Full test suite passes (uv run pytest tests/ --no-cov)

Risk assessment

Low risk — purely additive change to the Docker build (one extra go install and one extra COPY). Does not modify any existing binaries, Python code, or behavior. If it causes issues (e.g. build time, image size), it can be reverted by removing the two added lines.