fix(kube): reject dry run when server-side apply is disabled in Update()

Client-side update paths (patchResourceClientSide, replaceResource) do not
honor the dryRun flag, so Update(..., DryRun(true), ServerSideApply(false))
would still perform real writes. Add a guard that returns an error in the
same style as the existing forceConflicts && !serverSideApply check.

Signed-off-by: MrJack <36191829+biagiopietro@users.noreply.github.com>

pkg/kube/client.go

@@ -831,6 +831,10 @@ func (c *Client) Update(originals, targets ResourceList, options ...ClientUpdate
 		return &Result{}, errors.New("invalid operation: cannot use server-side apply and force replace together")
 	}
 
+	if updateOptions.dryRun && !updateOptions.serverSideApply {
+		return &Result{}, errors.New("invalid operation: dry run requires server-side apply")
+	}
+
 	createApplyFunc := c.makeCreateApplyFunc(
 		updateOptions.serverSideApply,
 		updateOptions.forceConflicts,