k8s/agent-access: a namespace-limited service account and kubeconfig for a coding agent

Read-only by default, optional deploy role; no Secrets, exec,
port-forward or RBAC. Tokens from kubectl create token, time-limited.
Not applied.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/agent-access/serviceaccount.yaml

@@ -0,0 +1,11 @@
+# The identity a coding agent uses on the cluster. It exists only in the mg4 namespace and is
+# never mounted into a pod; its tokens are made by hand with `kubectl create token` (README.md).
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mg4-agent
+  namespace: mg4
+  labels:
+    app.kubernetes.io/part-of: mg4
+    app.kubernetes.io/component: agent-access
+automountServiceAccountToken: false