feat(k3s-baseline): complete WP-0002 T01-T05

- bootstrap.yml: install k3s (server+cluster-init, pinned v1.35.1+k3s1)
  and Helm (v3.17.3 with checksum verify); fetch kubeconfig to control node
- tests/smoke_kube.sh: assert node Ready, helm, CoreDNS, Traefik
- docs/kubeconfig.md: usage, merge, context-switch, security note
- Makefile: k3s-install and smoke targets with make help

Closes T01, T02, T03, T04, T05 of RAIL-BS-WP-0002.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/smoke_kube.sh

@@ -1,5 +1,41 @@
 #!/usr/bin/env bash
 set -euo pipefail
-kubectl get nodes
-kubectl get ns
-echo "[OK] basic k8s API reachable"
+
+PASS=0
+FAIL=0
+
+ok()   { echo "[OK]   $*"; ((PASS++)) || true; }
+fail() { echo "[FAIL] $*"; ((FAIL++)) || true; }
+
+# ── Node Ready ───────────────────────────────────────────────────────────────
+if kubectl get nodes 2>/dev/null | grep -q " Ready"; then
+  ok "Node(s) in Ready state"
+else
+  fail "No nodes in Ready state"
+fi
+
+# ── Helm ─────────────────────────────────────────────────────────────────────
+if helm version --short &>/dev/null; then
+  ok "helm version: $(helm version --short)"
+else
+  fail "helm not available or erroring"
+fi
+
+# ── CoreDNS ──────────────────────────────────────────────────────────────────
+if kubectl get pods -n kube-system -l k8s-app=kube-dns 2>/dev/null | grep -q "Running"; then
+  ok "CoreDNS pod running in kube-system"
+else
+  fail "CoreDNS pod not running in kube-system"
+fi
+
+# ── Traefik ──────────────────────────────────────────────────────────────────
+if kubectl get pods -n kube-system -l app.kubernetes.io/name=traefik 2>/dev/null | grep -q "Running"; then
+  ok "Traefik ingress controller running in kube-system"
+else
+  fail "Traefik ingress controller not running in kube-system"
+fi
+
+# ── Summary ──────────────────────────────────────────────────────────────────
+echo ""
+echo "Results: ${PASS} passed, ${FAIL} failed"
+[[ "$FAIL" -eq 0 ]]