M0: Reach a spoke's in-cluster Grafana/Argo CD from the hub via scoped token

[gnanirahulnutakki]

Milestone-0 — the deciding step. From the hub, reach a spoke's in-cluster service (Grafana or Argo CD) through cluster-proxy, authenticating with a scoped managed-serviceaccount token (not a cluster-admin kubeconfig).

Tasks

• Deploy a trivial in-cluster service (or Grafana / Argo CD) on each spoke
• From the hub, reach spoke-a's service via cluster-proxy using the MSA token
• Repeat for spoke-b
• Time the end-to-end setup

Acceptance (the falsification verdict)

• ✅ Reachable in ≤ ~1 day of setup → the "build the transport/agent" scope is deleted; ADR-0001 → Accepted; proceed to Phase 1.
• ❌ Not reachable / needs bespoke transport → stop; ADR-0001 → Rejected; re-evaluate before any product code.

Refs: ROADMAP Milestone-0, ADR-0001.

[gnanirahulnutakki]

Superseded by the corrected completion evidence in #4 (comment).

[gnanirahulnutakki]

Correction to the preceding comment, whose Markdown formatting was stripped by a shell-quoting error.\n\nCompleted by PR #73, merged into dev at 017eec0.\n\nAcceptance evidence:\n- each spoke ran a deterministic local service with a distinct response;\n- managed-serviceaccount projected a separate sith-reader identity for each spoke;\n- the hub reached both services through cluster-proxy;\n- the same real token path was denied cluster-wide secrets and nodes with the expected ServiceAccount identity;\n- projected secrets contained only ca.crt and token, never a kubeconfig.\n\nExecutable proof: hack/experiments/m0-ocm-falsification.sh. PR CI run 29172067820 is green.