bug: add Kubernetes configuration to the CLI wizard

[Trifunovich]

Actual: Kubernetes cluster auditing can be configured only by editing JSON; the interactive CLI wizard has no Kubernetes configuration path.

Expected: The wizard collects and live-probes the required Kubernetes connection and scope settings, writes a valid kubernetesClusters configuration, reflects it in its summary, and has regenerated transcript and automated coverage.

Found while completing the Kubernetes coverage feature.

[Trifunovich]

Pre-merge review checklist for PR #19:

• The wizard probes Kubernetes readiness with the same read-only command used by Doctor, and probes the read-only Velero Backup query before accepting that setting.
• Explicit no-Velero configuration persists as veleroNamespace: null; omission retains the existing velero default.
• The wizard rejects a cluster with both audit surfaces disabled.
• Fake-lab coverage and regenerated transcripts exercise happy, rejected-input, and skipped paths.
• Public documentation and both sample copies no longer describe Kubernetes as wizard-excluded.
• The stale private roadmap statement was corrected in future-of-the-world commit 908e66c.
• Two requested external review seats were unavailable (session capacity and quota); independent fallback reviews found no merge blocker.

Verification: Release build has zero warnings; 277 tests pass; sample JSON copies are byte-identical.

[Trifunovich]

Resolved by PR #19 (764e2a2).

• Added Kubernetes/K3s setup to the first-run wizard: it live-probes the configured kubectl readiness command and optional Velero Backup access, then includes the cluster in the configuration summary.
• Explicit no-Velero setup is now written as veleroNamespace: null; omission continues to mean the existing velero default. A cluster with no enabled audit surface is not written.
• Regenerated the happy, rejected-input, and skipped dialogue transcripts; updated fake-lab coverage, public docs, README, changelog, and both sample copies.
• Verification: Release build had zero warnings; local suite passed 277 tests; PR CI passed.
• The prior Kubernetes-wizard exclusion was a scope error. The private roadmap correction is future-of-the-world commit 908e66c.

Non-scope: run restoreguard init against a real Kubernetes control-plane SSH destination before relying on this new wizard path in a production audit.