Add generator/render_ondemand.py rendering a kind: ondemand pipeline whose
pre-step runs nix-estimate --json (asserts sizing.version==1), orders an
EphemeralBuilder class:ci via nix-estimate --provision ci | kubectl apply,
waits Ready, builds pinned via backend_options.kubernetes.nodeSelector
(Option B plain-worker), and reaps the CR (runs_on success+failure). Keeps
the GENERATED header + arch banner, no || true (reap uses --ignore-not-found).
Adds manifests/ondemand-release-amd64.yaml + rendered example; render is pure
and deterministic. render_thin_quartet skips kind: ondemand by design.
