feat: add sunbeam k8s kubectl passthrough; fix kube_exec container arg

kube.py: kube_exec now accepts an optional container= kwarg so callers
can target a specific container in Linkerd-injected pods (where exec
would otherwise land in the linkerd-proxy sidecar instead of the app).
Used by check_valkey (container="valkey") and check_openbao
(container="openbao").

kube.py + cli.py: new cmd_k8s / sunbeam k8s verb — transparent
kubectl --context=sunbeam passthrough for one-off cluster operations.
Returns kubectl's exit code directly.

sunbeam/cli.py

@@ -64,6 +64,11 @@ def main() -> None:
     # sunbeam bootstrap
     sub.add_parser("bootstrap", help="Create Gitea orgs/repos; set up Lima registry")
 
+    # sunbeam k8s [kubectl args...] — transparent kubectl --context=sunbeam wrapper
+    p_k8s = sub.add_parser("k8s", help="kubectl --context=sunbeam passthrough")
+    p_k8s.add_argument("kubectl_args", nargs=argparse.REMAINDER,
+                       help="arguments forwarded verbatim to kubectl")
+
     args = parser.parse_args()
 
     if args.verb is None:
@@ -123,6 +128,10 @@ def main() -> None:
         from sunbeam.gitea import cmd_bootstrap
         cmd_bootstrap()
 
+    elif args.verb == "k8s":
+        from sunbeam.kube import cmd_k8s
+        sys.exit(cmd_k8s(args.kubectl_args))
+
     else:
         parser.print_help()
         sys.exit(1)