Initial import: phase docs, configs, Claude conventions

Phase 1-3 runbooks and design notes, version pins, config templates,
project-history conventions, cluster-inspector read-only credentials setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/cluster-inspector/rbac.yaml

@@ -0,0 +1,43 @@
+# Read-only identity for the cluster-inspector agent.
+# Apply to the management cluster and to every workload cluster the agent should inspect
+# (CAPI rules are simply unused on workload clusters).
+# Built-in `view` excludes Secrets; capi-readonly adds read access to CAPI CRDs and pod logs.
+# Tokens are short-lived TokenRequest tokens minted by make-kubeconfig.sh — no Secret-based token.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: readonly-inspector
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: capi-readonly
+rules:
+  - apiGroups:
+      - cluster.x-k8s.io
+      - infrastructure.cluster.x-k8s.io
+      - controlplane.cluster.x-k8s.io
+      - bootstrap.cluster.x-k8s.io
+      - ipam.cluster.x-k8s.io
+      - addons.cluster.x-k8s.io
+      - clusterctl.cluster.x-k8s.io
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods/log"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: readonly-inspector-view
+roleRef: { apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: view }
+subjects: [{ kind: ServiceAccount, name: readonly-inspector, namespace: kube-system }]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: readonly-inspector-capi
+roleRef: { apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: capi-readonly }
+subjects: [{ kind: ServiceAccount, name: readonly-inspector, namespace: kube-system }]