cluster-inspector: read-only kubeconfig for lab1, workload-aware triage

The agent could only reach lab-mgmt, so it couldn't verify nodes, CNI or
system pods on lab1. It correctly refused the admin ~/.kube/lab1.kubeconfig
when the owner's permission was relayed through the main session.

Workload kubeconfigs:
- make-kubeconfig.sh: new --capi-cluster [NS/]NAME. --admin-kubeconfig
  is then the management cluster. The workload admin kubeconfig is read
  from Secret NS/NAME-kubeconfig into a mktemp file, removed on exit, so
  no admin file for the workload cluster lands on disk.
- ansible/mgmt.yml --tags inspector now also mints kubeconfigs for every
  cluster in the new inspector_workload_clusters (group_vars: lab1).
  Clusters without a <name>-kubeconfig Secret are skipped. The tag is now
  the single weekly token refresh; tasks stay changed_when: false, so the
  playbook's changed=0 rule still holds.
- Owner ran --tags inspector: kubeconfigs/lab1.kubeconfig (lab1-ro)
  minted, can-i checks as expected.

Agent prompt:
- Cluster map: what to inspect on lab-mgmt vs the workload cluster.
  Machine -> Node -> VM via nodeRef, providerID and
  ProxmoxMachine.spec.virtualMachineID (checked on live objects).
- New triage step: scale-down blockers (non-DaemonSet kube-system pods
  without PDB, local storage, bare pods, PDBs at 0, safe-to-evict /
  scale-down-disabled).
- Refuses admin kubeconfigs even when a caller relays permission; points
  the owner to --tags inspector on missing file or 401.
- Verb before --kubeconfig so commands match the kubectl get/describe/logs
  allow rules; single-quote jsonpath/custom-columns for zsh.
- Report format: abnormal first, then health summary, then unverified.

settings.json: allow kubectl describe/logs/events and clusterctl describe.
All four are read-only, and the RO kubeconfigs enforce read-only anyway.

Checked: bash -n on the script; ansible-playbook --syntax-check and
ansible-lint --profile production pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/cluster-inspector/README.md

@@ -26,15 +26,23 @@ rm /tmp/lab-mgmt-admin.yaml
 
 ## 2. Workload clusters (after phase 1 step 3)
 
+Add the cluster to `inspector_workload_clusters` in `ansible/group_vars/all.yml`. Then
+`ansible-playbook mgmt.yml --tags inspector` mints a read-only kubeconfig for lab-mgmt and for every
+listed cluster whose `<name>-kubeconfig` Secret exists. Clusters without that Secret are skipped.
+
+Doing it by hand gives the same result. `--capi-cluster` reads the workload admin kubeconfig from
+the management cluster's Secret into a temp file that is deleted on exit:
+
 ```bash
-clusterctl get kubeconfig lab1 > /tmp/lab1-admin.yaml     # run against the mgmt cluster (admin)
-.claude/cluster-inspector/make-kubeconfig.sh lab1 --admin-kubeconfig /tmp/lab1-admin.yaml --apply-rbac
-rm /tmp/lab1-admin.yaml
+.claude/cluster-inspector/make-kubeconfig.sh lab1 \
+  --admin-kubeconfig ~/.kube/lab-mgmt.kubeconfig \
+  --capi-cluster default/lab1 \
+  --apply-rbac
 ```
 
 ## Expected verification output
 
-```
+```text
   list pods                                     yes
   get machines.cluster.x-k8s.io                 yes    # "no" on workload clusters (no CAPI CRDs), fine
   delete machines.cluster.x-k8s.io              no
@@ -46,7 +54,8 @@ Anything else means the RBAC is wrong. Don't use the agent until it matches.
 
 ## Refresh / revoke
 
-- **Refresh:** re-run the same command without `--apply-rbac`. The default lifetime is 7 days
+- **Refresh:** `ansible-playbook mgmt.yml --tags inspector` refreshes all clusters. You can also
+  re-run the same script command, with or without `--apply-rbac`; it's idempotent. The default lifetime is 7 days
   (`--duration`); the API server may cap it (`--service-account-max-token-expiration`).
 - **Revoke everything:** `kubectl delete sa -n kube-system readonly-inspector` (as admin). That
   invalidates every minted token; re-apply `rbac.yaml` to start over.