feat(atlas): Phase C — live Flux reconcile status on stage 07

Stage 07 now also shows the Flux `apps` Kustomization state — reconciled/failed
+ last-applied revision (main@shortsha) — read in-cluster (new read-only Role in
flux-system). Sits alongside the live deploy node. FluxStatus/FluxNode test-first,
fallback-safe.

Verified: build/vet/lint(0)/test green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/cluster/client.go

@@ -29,6 +29,12 @@ func Deployment() ([]byte, error) {
 	return get("/apis/apps/v1/namespaces/cad-atlas/deployments/cad-atlas")
 }
 
+// FluxKustomization returns the raw JSON for the Flux `apps` Kustomization that
+// reconciles this repo's manifests.
+func FluxKustomization() ([]byte, error) {
+	return get("/apis/kustomize.toolkit.fluxcd.io/v1/namespaces/flux-system/kustomizations/apps")
+}
+
 func get(path string) ([]byte, error) {
 	host, port := os.Getenv("KUBERNETES_SERVICE_HOST"), os.Getenv("KUBERNETES_SERVICE_PORT")
 	if host == "" || port == "" {