It needed a lot of thinking...
+ move k8s.io/apimachinery fork from go.work to go.mod (and include it in vendor)