feat: Add kubeconfig refresh script and fix Ansible Finalize to use public IP

- scripts/refresh-kubeconfig.sh fetches a fresh kubeconfig from CP1
- Ansible site.yml Finalize step now uses public IP instead of Tailscale
  hostname for the kubeconfig server address
- Updated AGENTS.md with kubeconfig refresh instructions

AGENTS.md

@@ -66,6 +66,13 @@ Repository guide for agentic contributors working in this repo.
 - Prefer validating the exact directory you edited, not the whole repo, unless the change is cross-cutting.
 - For Flux changes, verify the relevant `Kustomization`/`HelmRelease`/`ExternalSecret` manifests render cleanly before committing.
 
+### Kubeconfig refresh
+
+After a full cluster rebuild, the kubeconfig goes stale (new certs, new IPs). Refresh it with:
+- `scripts/refresh-kubeconfig.sh <cp1-public-ip>` (preferred)
+- Or manually: `ssh -i ~/.ssh/infra root@<cp1-ip> "cat /etc/rancher/k3s/k3s.yaml" | sed 's/127.0.0.1/<cp1-ip>/g' > outputs/kubeconfig`
+- The Ansible `site.yml` Finalize step also rewrites the server address to the public IP during bootstrap.
+
 ## Code Style
 
 ### General