Fix k8smount dropping keys mounted at nested paths

[ybai08]

When a ConfigMap or Secret key is projected at a nested path (items: - key: level, path: log/level, or a projected volume with path: certs/ca.crt), the kubelet does not link the file itself at the top of the mount. It links the first directory instead (createUserVisibleFiles in atomic_writer.go):

..2026_10_17_00_00_00.000000000/name
..2026_10_17_00_00_00.000000000/log/level
..data -> ..2026_10_17_00_00_00.000000000
name   -> ..data/name
log    -> ..data/log

fs.WalkDir doesn't follow symlinks, so log was seen as a directory and never walked, and log.level was missing from the result with no error. The provider docs say such a key "will always produce {"log":{"level":"INFO"}}", and that holds for a plain directory but not for a real volume mount.

before: map[name:app]
after:  map[log:map[level:INFO] name:app]

The fix: when walkDir resolves a top-level symlink to a directory (other than ..data and the timestamped dirs), Read walks it. fs.WalkDir does follow a symlink when it's given as the root. The walk follows only top-level links, because those are the only ones the kubelet creates. A link to a directory further down, such as one pointing back at the mount, is still not followed, so there's no loop.

writeVolumeMountAt in the test helper now makes the same links as the kubelet for nested keys (link the first path segment). Before, it couldn't create a nested key at all, because os.Symlink("..data/log/level", "log/level") fails without a log dir. There's also a new nested path case in Test_K8SMount_Read_WithVolumeMount.

Tests (from providers/k8smount, GOWORK=off because the module isn't in go.work):

• go test -run Test_K8SMount_Read_WithVolumeMount . without the provider change: nested_path fails (actual: map[a_foo:foo-value]); with it: passes.
• go test ., go test -race ., go vet ., gofmt -l .: clean.

Not run: Go 1.23/1.24 from the CI matrix, which doesn't cover this module anyway (it needs Go 1.25 and isn't in go.work). Not tried against a real cluster.