Agent socket CSI driver

Enable with --set csi.enabled=true on the watchtower-agent chart. It installs a CSIDriver (socket.csi.watchtower.io, ephemeral volumes only) and a per-node DaemonSet running wt-agent -mode csi. A pod then reaches the node agent's unix sockets without a hostPath:

volumes:
  - name: wt
    csi:
      driver: socket.csi.watchtower.io
      readOnly: true
      volumeAttributes: { socketDir: /var/run/wt-agent }   # optional, default socketRoot
containers:
  - volumeMounts: [{ name: wt, mountPath: /var/run/wt-agent }]

Point the agent's modules.dogstatsd.socket at a path below csi.socketRoot (default /var/run/wt-agent); the agent DaemonSet mounts that directory too. The driver bind-mounts the node directory into the pod (read-only when the volume is), and refuses any socketDir outside socketRoot, so a pod cannot use it to mount arbitrary host paths. It registers itself with the kubelet; no node-driver-registrar sidecar. The driver pod is privileged (mount(2)); it serves only a unix socket and reads no secret. Code: go/agent/csi.