feat(api): validate grid search space and trial budget

[sanskar-singh-2403]

What this PR does / why we need it:

Grid search enumerates the full cartesian product of the search space up front, so it needs a discrete space and a numTrials budget that actually fits that product. The OptimizationJob API enforced neither, so an invalid grid config passed admission and then failed with a Python traceback from inside the suggestion-optuna container, with nothing pointing at the offending field. Katib rejects both cases before the Experiment starts; this PR brings that same pre-flight validation to Trainer.

Two checks are added:

1. CEL rule on OptimizationJobSpec: when grid is set, every parameter must use a categorical search space.

   • This rejects both uniform and logUniform, for both Int and Float types.
   • Int is deliberately not treated as a safe case. Katib's INTEGER branch calls int(parameter.step) on an empty string and raises before the finite-range logic runs, so a rule that only rejected Float would still let a broken Int config through. Reference: https://github.com/kubeflow/katib/blob/dec5030ef9791add2a7224d8ba3cb9b699bf70da/pkg/suggestion/v1beta1/internal/search_space.py#L53-L62

2. Webhook ValidateCreate: reject a grid job whose numTrials exceeds the number of grid combinations (the product of the categorical choice-set sizes).

   • This is a product/fold across the parameter list, which CEL cannot express, so it lives in the validating webhook that previously delegated everything to CEL. Mirrors Katib's ValidateAlgorithmSettings. Reference: https://github.com/kubeflow/katib/blob/dec5030ef9791add2a7224d8ba3cb9b699bf70da/pkg/suggestion/v1beta1/optuna/service.py#L242-L251
   • The combination product is computed with early termination once it reaches numTrials, so it stays correct and cannot overflow int64 even at the API's MaxItems bounds (up to 100 parameters x 100 choices each).

The step-field alternative (quantised continuous spaces mapping onto Katib's FeasibleSpace.step) is intentionally out of scope here, since it is an API-surface addition better tracked separately under KEP-3562.

Testing:

• Unit tests for the trial-budget check, including the equal-to-combinations boundary, the single-choice case, and a wide-parameter overflow regression.
• Integration (envtest) cases covering both the CEL path (uniform / logUniform / Int rejected, categorical accepted, random with a continuous param accepted) and the webhook path (numTrials exceeding combinations rejected).

Note on base branch: this builds on the OptimizationJob CRD from #3552, which is not yet merged. It targets that work and should be rebased onto master once #3552 lands.

Which issue(s) this PR fixes (optional, in Fixes #<issue number>, #<issue number>, ... format, will close the issue(s) when PR gets merged):

Fixes #3862

Checklist:

• Docs included if any changes are user facing

/area hpo
/kind feature

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign andreyvelich for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment