Fence KubernetesExecutor launches with external executor IDs

[wolvery]

What

Fixes #69760.

This adds DB-backed launch-token fencing for KubernetesExecutor task launches:

• opt KubernetesExecutor into scheduler pre-assigned external_executor_id tokens
• serialize the token into Airflow 3 ExecuteTask workloads and worker /run requests
• annotate Kubernetes pods with the executor launch token
• reject stale /execution/task-instances/{id}/run requests when the DB token no longer matches
• revalidate queued Kubernetes jobs against the current DB row/token immediately before pod creation

This prevents stale Kubernetes workloads from validly transitioning an obsolete task instance launch to RUNNING after a newer queued launch has replaced it.

Tests

• python3 -m compileall ... on modified source and test files
• uv run ruff check ...
• uv run ruff format --check ...
• git diff --check

Targeted pytest was attempted, but the local uv environment is corrupted independently of this change: pytest collection repeatedly failed on missing/broken installed dependencies such as pluggy, annotated_types, six, methodtools, python-dateutil, requests_oauthlib, and referencing after uv reported it could not parse exclude-newer = "4 days" in pyproject.toml and ignored the lockfile. The code-level compile and ruff checks passed after restoring uv.lock.

Gen-AI disclosure

• Yes: GPT was used to assist in authoring this PR. The changes were reviewed and validated by the contributor before submission.

Generated-by: GPT following the guidelines: https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions