Record step 2 of mgmt cluster plan; widen inspector read-only RBAC

Inspector role can now read operator Provider CRs, k3s HelmCharts and nodes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/cluster-inspector/rbac.yaml

@@ -22,11 +22,17 @@ rules:
       - ipam.cluster.x-k8s.io
       - addons.cluster.x-k8s.io
       - clusterctl.cluster.x-k8s.io
+      - operator.cluster.x-k8s.io   # cluster-api-operator Provider CRs
+      - helm.cattle.io              # k3s HelmChart CRs
     resources: ["*"]
     verbs: ["get", "list", "watch"]
   - apiGroups: [""]
     resources: ["pods/log"]
     verbs: ["get", "list"]
+  # built-in `view` has no cluster-scoped core resources; nodes are needed for providerID checks
+  - apiGroups: [""]
+    resources: ["nodes", "namespaces"]
+    verbs: ["get", "list", "watch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding