k8s-review

# Kubernetes Review Review one explicit target without taking ownership of it. A review request never authorizes apply, delete, restart, rollout, scale, patch, drain, cordon, namespace creation, cluster lifecycle, or volume mutation. Compose [k8s-local](../k8s-local/SKILL.md) for lifecycle or deployment work. Use the repository-owned `dot cluster diagnose` collector and its versioned `dot.cluster.diagnostics/v1` schema instead of assembling ad hoc `kubectl` output. Read the [review matrix](references/review-matrix.md) for dimension-specific evidence and exercise the [behavioral evaluations](tests/behavioral-evaluations.md) when changing this workflow. Agent metadata is in [openai.yaml](agents/openai.yaml). ## Target and authority gate 1. Read repository instructions and identify an explicit or repository-derived kubeconfig, context, namespace, and ownership boundary. Never fall back to the user's default current context. 1. Display the intended kubeconfig, context, namespace, and permitted evidence scope. If derivation is ambiguous, stop before any cluster probe. 1. Verify the selected target through `dot cluster --kubeconfig <path> --context <context> status`. Treat a missing tool, absent cluster, unavailable API, context mismatch, namespace mismatch, or authorization failure as a bounded result, not permission to switch targets. 1. For review-only work, keep every operation read-only. If the user later authorizes a mutation, hand lifecycle, deployment, or teardown to `k...