lab1 provisioned: fix IPAddress kubectl name, inspector CRD read, review notes

- runbook + inspector agent: ipaddresses.ipam.cluster.x-k8s.io (plain
  `ipaddresses` is the built-in networking.k8s.io type on k8s 1.35)
- inspector RBAC: get/list CRDs so clusterctl describe works read-only
- phase-1 Step 3 ticked; session note with the first lab1 review

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/phase-1-proxmox-capi.md

@@ -19,7 +19,7 @@ Versions: see [versions.md](versions.md). Template build: see [image-builder-pro
 - [x] Step 0 — Proxmox prep (API token, ACLs, bridge/VLAN, IP ranges)
 - [x] Step 1 — VM template `ubuntu-2404-kube-v1.35.9` built and smoke-tested
 - [x] Step 2 — management cluster (`ansible/mgmt.yml`: k3s + cluster-api-operator + providers)
-- [ ] Step 3 — workload cluster `lab1`
+- [x] Step 3 — workload cluster `lab1` (VMs 102/103, `.31`/`.32`, VIP `.30`)
 - [ ] Step 4 — CNI (Cilium)
 - [ ] Step 5 — MachineDeployment autoscaling annotations
 - [ ] Step 6 — cluster-autoscaler
@@ -117,7 +117,8 @@ kubectl get proxmoxmachines,machines -w
 clusterctl get kubeconfig lab1 > lab1.kubeconfig
 ```
 
-Node IPs come from the IPAM pool (`kubectl get ipaddressclaims,ipaddresses`). providerID is set by
+Node IPs come from the IPAM pool (`kubectl get ipaddressclaims,ipaddresses.ipam.cluster.x-k8s.io`;
+plain `ipaddresses` resolves to the built-in `networking.k8s.io` type on k8s ≥ 1.33). providerID is set by
 the CAPMOX template as `proxmox://{{ ds.meta_data.instance_id }}` — don't touch it, the autoscaler
 matches Nodes to Machines by it.