feat: support EKS 1.36 and 1.37

[bryantbiggs]

Raises the latest supported Kubernetes version to 1.37 and the minimum to 1.32, and adds checks for the 1.36 changes that EKS upgrade insights do not report. Both new versions are generally available on EKS (1.36 on 2026-06-02, 1.37 on 2026-10-01).

Supported versions

• LATEST goes from 35 to 37, and data.yaml gains release links for 1.36 and 1.37. Neither has a section in the upstream deprecation guide, so neither has a deprecation_url.
• MINIMUM goes from 30 to 32, so only versions EKS still supports are accepted. Extended support ended for 1.30 on 2026-07-23 and ends for 1.31 on 2026-11-26. The 1.30 to 1.32 entries leave data.yaml, since the earliest possible target is now 1.33. No check is newly retired.
• A unit test checks that data.yaml has release data for every target from MINIMUM + 1 to LATEST.
• The test fixtures move from a 1.30 cluster to 1.32, with node versions and targets moved up by two so every version gap stays the same. The e2e test for a deprecation link being present is removed, because no supported target has a deprecation-guide section. The link rendering is unchanged.

K8S012 correction

K8S012 (kube-proxy IPVS mode) used to say IPVS is removed in 1.36 and became a required fix for targets of 1.36 and later. IPVS was not removed in 1.36. The 1.37 release notes say it logs a deprecation warning, is expected to be off by default in 1.40, and is expected to be removed in 1.43 (KEP-5495). Without this fix, raising LATEST would have reported a blocker that does not exist. The check now stays at recommended for every target.

New checks, from 1.36 targets

None of these appear in the published EKS upgrade insight checks. The insights permissions cannot read pods or Services, so EKS cannot see the last two at all.

• K8S014, required: nodes running containerd 1.x. EKS says 1.35 is the last release that supports containerd 1.x. The check reads the runtime version each node reports, now kept on Node. It is node level, so it has no ignore support. Fargate and EKS Auto Mode nodes are skipped, because AWS manages their runtime.
• K8S015, required: workloads with gitRepo volumes, which the kubelet refuses to run from 1.36 (KEP-5040). It walks the same workload pod templates as the other workload checks and supports ignore.
• K8S016, recommended: Services that set spec.externalIPs, deprecated in 1.36 with removal planned for 1.43 (KEP-5707). This adds a cluster-wide Services list, made only for targets of 1.36 and later, so eksup needs list access to Services for those targets. It supports ignore by Service name and namespace.

1.37 playbook notes

Two 1.37 changes depend on CSI driver settings and on kubelet flags, which the Kubernetes API does not expose: the SELinux mount default and the deprecated cAdvisor flags. Rather than checks, data.yaml gains an optional per-version notes list, shown in the playbook's pre-upgrade review list. 1.37 carries one note for each change.

Resolves #188

Local gate: nightly fmt, clippy -D warnings, cargo test --all and xtask generate-all --check pass.