Long-lived Deployment (sleep infinity) plus ConfigMap and Secret for
PALETTE_HOST / PALETTE_API_KEY. Each MCP client session is spawned via
`kubectl exec -i deploy/palette-mcp -- palette-mcp`, which inherits
the pod's env — including PALETTE_CA_FILE, set in the container spec
so it survives beyond the startup shell.

CA precedence on pod start mirrors the docker container: mounted
`palette-ca` Secret with key ca.crt first, then `openssl s_client`
auto-fetch from $PALETTE_HOST:443. Optional RBAC in rbac.yaml grants
a group pods/exec without needing cluster-admin. Wiring snippets for
Claude Code, Claude Desktop, Cursor, and Codex included.