docs: clarify patch merge semantics

[ANAMASGARD]

Explanation

Chainsaw’s native patch operation uses JSON Merge Patch semantics. When users provide a sparse Pod container entry, the entire spec.containers array is replaced, which can remove defaulted or injected fields and cause Kubernetes to reject the update.

This PR documents the existing behavior and adds regression coverage. It does not change runtime patch semantics or introduce a new patch mode.

Related issue

Fixes #2764

Proposed Changes

• Add a structural regression test proving that native patch:
  • uses types.MergePatchType;
  • preserves the live resourceVersion;
  • replaces the supplied containers array as-is;
  • does not merge omitted container fields such as resources.
• Document JSON Merge Patch object, null, and array behavior.
• Explain the Pod/container-image failure mode.
• Document RFC 6902 JSON Patch through the script operation as the precise-field workaround.
• Preserve all existing runtime behavior and APIs.

Checklist

• I have read the contributing guidelines.
• I have read the PR documentation guide and followed the process including adding proof manifests to this PR.
• This is a bug fix and I have added unit tests that prove the documented native patch contract.

Further Comments

This PR intentionally does not make sparse native Pod image patches succeed. That would require a separate maintainer-approved runtime/API design.

Validation performed:

• go test ./pkg/engine/operations/patch -count=1 — PASS
• go test ./pkg/client -count=1 — PASS
• go test ./pkg/engine/operations/... -count=1 — PASS
• mkdocs build -f ./website/mkdocs.yaml — PASS
• git diff --check — PASS
• Disposable Kind reproduction with the installed Chainsaw CLI:
  • native sparse Pod patch — rejected as expected;
  • RFC 6902 image patch — succeeded.
• go test ./... -count=1 — BLOCKED by the environment’s disk-quota limit while compiling Kubernetes dependencies.