feat(mecak8s): add Dex Kind fixture

[jhrozek]

Summary

Extends the ToolHive-free local Kind profile (deploy/mecak8s-vmcp/) with an in-cluster Dex identity provider (two disposable users, alice@example.com / bob@example.com), satisfying #634's "an IDP is deployed so that two users can drive concurrent conversations" acceptance criterion. task mecak8s:kind-setup now also deploys Dex; Dex is reachable in-cluster and prepared for mecak8s to validate its tokens once OIDC is enabled (see #664, the next PR in this stack).

Part of #634.

Stack

3rd of a 4-PR stack (based on #661):

1. feat(redisstore): support authenticated TLS Redis connections (fixes Store hardening: auth, TLS and snapshot integrity #374)
2. feat(mecak8s): add production Helm deployment baseline
3. #this — Dex Kind fixture
4. feat(mecak8s): converge kustomize manifests into the Helm chart (fixes Create a set of task targets to deploy mecak8s to kind #634)

Test plan

• go test ./internal/deploycheck/...