k8s/agent-access: a namespace-limited service account and kubeconfig for a coding agent

Read-only by default, optional deploy role; no Secrets, exec,
port-forward or RBAC. Tokens from kubectl create token, time-limited.
Not applied.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/agent-access/kustomization.yaml

@@ -0,0 +1,8 @@
+# Agent access to the mg4 namespace, applied separately from k8s/: `kubectl apply -k k8s/agent-access/`.
+# Read-only by default; add role-deploy.yaml below to let the agent apply changes too.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - serviceaccount.yaml
+  - role-read.yaml
+  # - role-deploy.yaml