Remove the orphaned internal/k8sx package

[sourcehawk]

Problem

internal/k8sx has no production importers — only its own tests reference it. Its BuildRESTConfig duplicates the live copy in pkg/mcp/k8sx (the one the k8s MCP server actually uses), and its Client, New, NamespaceExists, and CanListPods are dead. NamespaceExists/CanListPods were written to gate session start but were never wired in, and client.go carries a comment claiming "callers ... use NamespaceExists / CanListPods" that no caller honors. The package has been orphaned since the initial public release.

It is pure residue, and it actively misleads: AGENTS.md documents internal/k8sx as the hot-swappable atomic.Pointer client, but that behaviour actually lives in pkg/mcp/k8s.

Approach

• Delete the internal/k8sx package (client.go, client_test.go, preflight.go, preflight_test.go).
• Leave pkg/mcp/k8sx (the live BuildRESTConfig) untouched.
• Fix the AGENTS.md internal/ tree entry: the "k8sx — k8s client extensions, hot-swappable via atomic.Pointer" line describes pkg/mcp/k8s, not internal/k8sx; correct or drop it.

Verification

• grep -rn 'internal/k8sx' --include=*.go returns nothing after removal.
• make test and make lint pass; make build produces both binaries.
• AGENTS.md no longer attributes the atomic.Pointer hot-swap client to internal/k8sx.

Out of scope

• pkg/mcp/k8sx stays; this removes the dead duplicate, it does not consolidate the two packages.
• No new preflight permission check: there's no namespace to validate at session start, so a permission error at first tool call is the intended behaviour.

Context

• internal/k8sx/{client,preflight}.go — orphaned package; zero importers.
• pkg/mcp/k8sx/client.go — the live BuildRESTConfig, used by pkg/mcp/k8s/server.go.
• pkg/mcp/k8s/{server,active_context}.go — the real atomic.Pointer hot-swap client.
• AGENTS.md internal/ tree — stale internal/k8sx description.
• Surfaced while correcting README preflight claims.