Clean up stale KubernetesPodOperator pods

[fat-catTW]

Why:

KubernetesPodOperator pods can remain in Kubernetes after their TaskInstance is no longer active when a sidecar container keeps the pod running.

This can leave stale pods consuming cluster resources even though Airflow has already moved on from the task attempt.

Related: #58968

Solution:

Add an optional KubernetesPodOperator zombie pod cleanup path for KubernetesExecutor.

When enabled, the executor periodically lists pods with the kubernetes_pod_operator=True label and compares them with unfinished TaskInstances in the Airflow DB.

A pod is deleted only when Airflow can identify the TaskInstance it belongs to from the pod labels, and either:

• the matching TaskInstance is no longer unfinished in the Airflow DB, or
• the pod belongs to an older try than the current TaskInstance try number.

A pod is not deleted when:

• its required identity labels are missing or malformed
• it still has a matching unfinished TaskInstance
• the cleanup has already reached kpo_zombie_pod_cleanup_max_deletes_per_loop for the current loop

Pods selected for deletion are processed oldest first by metadata.creation_timestamp.

The cleanup is disabled by default. Users can enable and tune it with the following [kubernetes_executor] config options:

• kpo_zombie_pod_cleanup_enabled
• kpo_zombie_pod_cleanup_interval
• kpo_zombie_pod_cleanup_max_deletes_per_loop
• kpo_zombie_pod_deletion_grace_period_seconds

This is scoped to KubernetesExecutor for now, with the cleanup logic kept in a reusable helper so it can be wired into other scheduler-side cleanup paths later.

Was generative AI tooling used to co-author this PR?

• [X] Yes (please specify the tool below)

Generated-by: [Codex] following the guidelines

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.