M1.5: NodeConfig dynamic informer + RBAC

Agent now watches nodeconfigs.flock.fritzlab.net via a client-go dynamic
informer, filters events to its own node name, and caches the typed
NodeConfig in memory (NodeConfigCache, atomic pointer). M2's IPAM will
read from that cache.

- pkg/agent/nodeconfig.go: informer + JSON-round-trip decode (avoids
  hand-written DeepCopy + scheme registration for this small a use).
- pkg/agent/server.go: starts the informer goroutine; Run terminates if
  the informer returns.
- pkg/api/v1alpha1: switch placeholder TypeMeta/ObjectMeta to metav1.
- deploy/rbac: get/list/watch on nodeconfigs.
- cmd/flock-agent: --kubeconfig flag for out-of-cluster runs (tests).

Satisfies M1 verified-by: "kubectl apply NodeConfig; agent logs read it".

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

cmd/flock-agent/main.go

@@ -16,9 +16,10 @@ import (
 
 func main() {
 	var (
-		node      = flag.String("node", os.Getenv("NODE_NAME"), "node name (defaults to $NODE_NAME)")
-		statePath = flag.String("state", "/var/lib/flock/allocations.json", "path to allocations.json")
-		socket    = flag.String("socket", agent.SocketPath, "unix socket for CNI RPC")
+		node       = flag.String("node", os.Getenv("NODE_NAME"), "node name (defaults to $NODE_NAME)")
+		statePath  = flag.String("state", "/var/lib/flock/allocations.json", "path to allocations.json")
+		socket     = flag.String("socket", agent.SocketPath, "unix socket for CNI RPC")
+		kubeconfig = flag.String("kubeconfig", os.Getenv("KUBECONFIG"), "kubeconfig path (empty = in-cluster)")
 	)
 	flag.Parse()
 
@@ -30,10 +31,11 @@ func main() {
 	}
 
 	srv, err := agent.NewServer(agent.Config{
-		Node:      *node,
-		StatePath: *statePath,
-		Socket:    *socket,
-		Logger:    logger,
+		Node:       *node,
+		StatePath:  *statePath,
+		Socket:     *socket,
+		Logger:     logger,
+		Kubeconfig: *kubeconfig,
 	})
 	if err != nil {
 		logger.Error("init server", "err", err)