fix(deploy): run kubectl plugins only through kubectl

[yalosev]

Summary

Backport of #408 to 2. With kubectl-argo-rollouts on PATH, werf kubectl argo rollouts get rollout demo now runs the plugin with get rollout demo. Commands outside werf kubectl no longer execute kubectl plugins while constructing the command tree.

What

• Standalone plugin lookup removes the kubectl command prefix and preserves plugin arguments.
• With WERF_SELF_INVOCATION_COMMAND=dk, the embedding invocation d8 dk kubectl argo rollouts get runs kubectl-argo-rollouts get; commands outside that path do not trigger lookup.
• Built-in kubectl commands retain precedence over plugins.
• The bundled kubectl v0.29.3 retains exact plugin lookup under create: werf kubectl create hello can run kubectl-create-hello, but create hello demo looks for kubectl-create-hello-demo instead of passing demo to the shorter plugin name.

Why

Kubectl expects the binary name followed by its own command arguments, but werf passed its entire argument vector. The extra command prefix prevented intended plugin lookup, while eager command construction could execute a plugin for an unrelated werf command.

[alexey-igrychev]

Review and verification at c14808b:

• Added subprocess coverage through the production NewCmd constructor, with isolated PATH and the v2 plugin-subcommand feature gate reset to its default. All 18 kubectl cases pass.
• Verified mutation sensitivity: bypassing argument normalization at the production call site fails 5 cases; returning the raw argument vector from the helper fails 14. Restoring the implementation passes the suite after each mutation.
• task build, full task lint:golangci-lint:go, and full task test:unit pass (73 suites). Go formatters pass.
• Scoped config and ci-env integration tests pass (7 + 4 cases), using the built binary.
• Actual CLI execution confirms ordinary and embedded-prefix plugin dispatch, rejection of unrelated root commands, and the bundled kubectl v0.29.3 exact-match behavior under create.
• Independent challenge review found no remaining actionable findings after the test fixes.

Limitations: full task format/task lint cannot complete their Docker-based Prettier step because the local Docker daemon is unavailable. The selected Docker build e2e also fails for that missing daemon; it is not reported as passing. Windows execution and the real embedding application were not exercised. External CI/environment blockers are excluded from merge gating at the maintainer's explicit request.