k8s/agent-access: a namespace-limited service account and kubeconfig for a coding agent

Read-only by default, optional deploy role; no Secrets, exec,
port-forward or RBAC. Tokens from kubectl create token, time-limited.
Not applied.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/README.md

@@ -54,6 +54,12 @@ the forge that can only **read** the `nils/mg4` repository, put it there, apply
 restart the server. Without it, updates are off (the car's updater gets a 404). `FORGE_URL`
 and `FORGE_REPO` are set in `server.yaml`.
 
+## Agent access
+
+[`agent-access/`](agent-access/README.md) creates a service account limited to the `mg4`
+namespace (read-only by default, no Secrets, no exec) and a script that writes a kubeconfig with a
+time-limited token for it. Applied separately, with `kubectl apply -k k8s/agent-access/`.
+
 ## Notes
 
 - InfluxDB's setup mode runs only on an empty volume. Changing `admin-token` in the Secret later