[#699] split k8s platform body of work out of PFVCluster

Framework enforcement layer adopted; shellcheck clean; real kubeconfigs
gitignored (example only in repo). Provenance: PFVCluster/k8s.
https://projects.knownelement.com/issues/699#note-4536

.env.example

@@ -0,0 +1,8 @@
+# k8s repo consumes no secrets from env files by design: node access is
+# root-SSH over Tailscale (keys via ssh-agent), and env.sh (sourced) holds
+# node rosters + wire-plan constants. Copy env.sh values from the cluster
+# runbook; never commit real kubeconfigs or tokens.
+#
+# Optional overrides when driving scripts by hand:
+#SSH_USER=reachableceo
+#SSH_OPTS=(-o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15)