fix(function): avoid data race on shared output in KubeExecAll

[anxkhn]

Change Overview

KubeExecAll runs a command across every pod/container in parallel. execAll
spawned one goroutine per pod/container, and each goroutine appended its command
stdout to a single shared string:

output := ""
...
go func(p string, c string) {
    stdout, _, err := KubeExecAndLog(ctx, cli, namespace, p, c, cmd, nil)
    errChan <- err
    output = output + "\n" + stdout   // shared, unsynchronized
}(p, c)

That is an unsynchronized read-modify-write of output shared across all N
goroutines, which is a data race on the string and can silently drop
concatenations when two appends interleave (lost update). It also writes
output after the send on errChan, so draining the error channel in the main
goroutine establishes no happens-before with that write: that same goroutine can
read output in parseLogAndCreateOutput while goroutines are still writing,
racing the read against the writes. Any KubeExecAll phase that targets more
than one pod or container (its whole purpose) can therefore drop or corrupt exec
output.

The fix keeps the change confined to execAll:

• Each goroutine writes into its own slot of a preallocated outputs slice keyed
  by index. Distinct indices never overlap, so the concurrent writes are
  race-free by construction (no mutex needed).
• The slot write now happens before the send on errChan. The main goroutine
  receives all N errors before joining any slot, so every per-container write
  happens-before the read in parseLogAndCreateOutput. Both the write/write and
  the read/write races are removed.
• Output is joined in the deterministic pod/container iteration order (it was
  previously nondeterministic goroutine-completion order). This does not change
  semantics: parseLogAndCreateOutput parses order-independent phase-output
  key/value lines into a map.

To make the concurrent path testable without a live cluster, the core is
extracted into execAllWith(..., exec execFunc) with an injectable exec seam
that defaults to KubeExecAndLog. execAll's signature and its only caller are
unchanged.

A release note is included under releasenotes/notes/.

• 🚧 Work in Progress
• 🌈 Refactoring (no functional changes, no api changes)
• 🐹 Trivial/Minor
• 🐛 Bugfix
• 🌻 Feature
• 🗺️ Documentation
• 🤖 Test
• 🏗️ Build

Issues

• N/A

Test Plan

• 💪 Manual
• ⚡ Unit test
• 💚 E2E

Added TestExecAllCollectsEveryContainerOutput (new KubeExecAllOutputTest
gocheck suite) in pkg/function/kube_exec_all_test.go. It fans out 4 pods x 3
containers through a fake exec that emits a distinct phase-output line per
pod/container, then asserts the parsed output map contains all 12 keys, so a lost
or corrupted concatenation shows up as a missing key. Run under the race
detector:

go test -race -run 'Test/TestExecAllCollectsEveryContainerOutput' \
  ./pkg/function/ -check.f 'KubeExecAllOutputTest'

The test fails under -race on the pre-fix body (the race detector fires on the
shared output string) and passes after the fix.

Also verified locally: go build -race ./pkg/function/..., go vet ./pkg/function/, and golangci-lint with the repo config on pkg/function (0
issues). The existing live-cluster suites (TestKubeExecAllDeployment,
TestKubeExecAllStatefulSet) still compile; they need a kubeconfig and were not
run locally.