Initial import: phase docs, configs, Claude conventions

Phase 1-3 runbooks and design notes, version pins, config templates,
project-history conventions, cluster-inspector read-only credentials setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -0,0 +1,19 @@
+# Changelog
+
+## 2026-09-27 00:02 CEST — Read-only cluster-inspector credentials next to the agent
+
+- Moved inspector RBAC from `configs/rbac/` to `.claude/cluster-inspector/` with `make-kubeconfig.sh`
+  (applies RBAC once, mints a short-lived TokenRequest token, writes gitignored
+  `kubeconfigs/<name>.kubeconfig`, runs `can-i` checks) and a setup README.
+- Dropped the long-lived `service-account-token` Secret; tokens default to 7 days, refresh by re-running.
+- `cluster-inspector` agent now reads only `.claude/cluster-inspector/kubeconfigs/*`; `.gitignore`
+  covers that dir and `.claude/settings.local.json`.
+- Files: `.claude/cluster-inspector/`, `.claude/agents/cluster-inspector.md`, `CLAUDE.md`, `README.md`,
+  `.gitignore`, `docs/decisions.md`.
+
+## 2026-09-26 23:55 CEST — Project history conventions
+
+- Adopted plan / execution-log / prompt / review / changelog conventions from
+  egress-proxies-operator, plus new `docs/decisions.md` (back-filled) and `docs/sessions/`.
+- Git flow: docs straight to `main`, phase-3 code via `feat/` branch + `tea` MR; `/ship` command.
+- Files: `CLAUDE.md`, `docs/decisions.md`, `docs/sessions/`, `.claude/`.