lab1 provisioned: fix IPAddress kubectl name, inspector CRD read, review notes

- runbook + inspector agent: ipaddresses.ipam.cluster.x-k8s.io (plain
  `ipaddresses` is the built-in networking.k8s.io type on k8s 1.35)
- inspector RBAC: get/list CRDs so clusterctl describe works read-only
- phase-1 Step 3 ticked; session note with the first lab1 review

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/agents/cluster-inspector.md

@@ -24,7 +24,8 @@ Triage order:
 2. Objects + conditions: `kubectl get cluster,kcp,md,ms,machines,proxmoxmachines -A -o wide`,
    `kubectl describe` the first non-Ready object.
 3. Controller logs: `capi-system/capi-controller-manager`, `capmox-system/capmox-controller-manager`,
-   `capi-kubeadm-*-system`, IPAM (`kubectl get ipaddressclaims,ipaddresses -A`).
+   `capi-kubeadm-*-system`, IPAM (`kubectl get ipaddressclaims,ipaddresses.ipam.cluster.x-k8s.io -A`; plain
+   `ipaddresses` is the built-in networking.k8s.io type).
 4. Node side: Node vs Machine providerID match
    (`kubectl get nodes -o custom-columns=N:.metadata.name,P:.spec.providerID`), kubelet/cloud-init
    status if SSH access is given.

.claude/cluster-inspector/rbac.yaml

@@ -33,6 +33,10 @@ rules:
   - apiGroups: [""]
     resources: ["nodes", "namespaces"]
     verbs: ["get", "list", "watch"]
+  # clusterctl describe checks the CAPI CRD storage version
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "watch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding