Harden Kubernetes homelab agent for K8SHomelab

[Quazmoz]

Summary

Qualify the Kubernetes homelab agent specifically against the current Quazmoz/K8SHomelab repository.

Changes

• rewrite the canonical homelab agent around current repo/runtime evidence rather than stale topology assumptions
• enforce K8SHomelab's Graft-first AGENTS.md workflow with a truthful GitHub-only fallback
• separate Git desired state, Flux controller state, Kubernetes runtime state, persistent data, and secret state
• make Flux watched-branch writes and prune: true explicit mutation boundaries
• add multi-cluster/kubeconfig safety and explicit context verification
• make Oracle/WireGuard behavior conditional on current evidence
• harden SOPS, destructive-action, retry/timeout, storage/network, and AI/MCP automation guardrails
• add a GitHub Copilot wrapper, quickstart, and 20-case adversarial acceptance suite
• update the GitOps change-management and homelab troubleshooting skills

Qualification target

The existing Validate AgentDefaults workflow must pass before merge. Runtime Kubernetes health is outside this repo-only change and is intentionally not claimed.