refactor: replace hand-written test mocks with gomock-generated mocks (#2775)

Introduce go.uber.org/mock (gomock) with mockgen code generation to
replace all hand-written mock structs across the test suite. This
eliminates duplicated mocks, establishes a single consistent mocking
pattern, and ensures mocks stay in sync with interface changes
automatically via make generate-mocks.

Infrastructure:
- Add mockgen via bingo with unversioned symlink for go generate
- Add generate-mocks Makefile target (go generate ./...)
- Wire into existing generate/verify targets for CI enforcement
- Centralized //go:generate directives in internal/testutil/mock/
  for exported interfaces (external and internal)
- Source-mode directives at interface definitions for unexported
  interfaces (trackingCache, sourcerer), output to _test.go files
  to keep gomock out of the production binary
- Mock helpers accept shared *gomock.Controller to avoid controller
  proliferation in nested mock scenarios

Rename MockPuller/MockCache to FakePuller/FakeCache in
image/fakes.go to clarify they are test fakes (preconfigured return
values), not mocks (interaction verification). Remove duplicated
FakeCertProvider from render/fake.go and rukpak/util/testing.go,
replaced by generated MockCertificateProvider. FakeBundleSource
(a function type, not an interface) is retained as-is.

Co-authored-by: Claude <noreply@anthropic.com>