feat(k8s): deploy 3-node k3s HA control plane over Tailscale

Bootstrap a regular (non-ITAR) k3s cluster on cnode1/2/3 with embedded
etcd. All cluster communication — node registration, API server, etcd
peering, flannel VXLAN — runs exclusively over Tailscale IPs. Zero LAN
addresses appear in node status or TLS certificates.

Scripts (k8s/):
- env.sh: shared config (Tailscale IPs, SSH opts, k3s version)
- wipe.sh: remove existing k3s from all cnodes
- install-cp.sh: full bootstrap (cnode1 --cluster-init, then cnode2/3 join)
- join-servers.sh: re-join cnode2/3 only (fixes broken join state)
- post-setup.sh: apply NoSchedule taints, fetch kubeconfig, verify
- verify.sh: 13-point health check (nodes, Tailscale IPs, taints, etcd,
  CoreDNS, API server, workload isolation)
- probe-nodes.sh: SSH + Tailscale reachability check

All 3 cnodes are tainted control-plane:NoSchedule so no user workloads
can schedule on the control plane. 13/13 health checks pass.

Docs updated: k8s README TL;DR reflects k3s (not Talos) as the deployed
choice, with Talos preserved for the future ITAR cluster.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

AGENTS.md

@@ -11,6 +11,7 @@ lives in subdirectories.
 provisioning/        Server provisioning (SetupNewSystem.sh, security, 2FA)
 tests/               Test suite + VM validation harness
 dns-cluster-setup/   Technitium DNS cluster replication
+k8s/                 k3s cluster setup scripts (3-node HA over Tailscale)
 perf/                Proxmox perf tuning, fleet audit, iperf
 netinfra/            pfv-netinfra-01/02 DNS/NTP setup
 switches/            Switch configuration captures