fix: kubeconfig server accessible via port forwarding, integration tests use proper auth

Bind kubeconfig HTTP server to 0.0.0.0:8080 (was 127.0.0.1) so integration
tests can reach it via QEMU SLIRP port forwarding. Add shared wait_for_boot
and fetch_kubeconfig helpers to qemu-helpers.sh. Update all 5 integration
tests to fetch kubeconfig via HTTP and use it for kubectl authentication.

All 6 tests pass on Linux with KVM: boot (18s), security (7/7), K8s ready
(15s), workload deploy, local storage, network policy.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

test/integration/test-k8s-ready.sh

@@ -7,21 +7,25 @@ set -euo pipefail
 ISO="${1:?Usage: $0 <path-to-iso>}"
 TIMEOUT_K8S=${TIMEOUT_K8S:-300}
 API_PORT=6443
+KC_PORT=8080
+SERIAL_LOG=$(mktemp /tmp/kubesolo-k8s-test-XXXXXX.log)
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 . "$SCRIPT_DIR/../lib/qemu-helpers.sh"
 
 DATA_DISK=$(mktemp /tmp/kubesolo-data-XXXXXX.img)
-dd if=/dev/zero of="$DATA_DISK" bs=1M count=1024 2>/dev/null
+dd if=/dev/zero of="$DATA_DISK" bs=1M count=2048 2>/dev/null
 mkfs.ext4 -q -L KSOLODATA "$DATA_DISK" 2>/dev/null
 
 QEMU_PID=""
 EXTRACT_DIR=""
+KUBECONFIG_FILE=""
 
 cleanup() {
     [ -n "$QEMU_PID" ] && kill "$QEMU_PID" 2>/dev/null || true
-    rm -f "$DATA_DISK"
+    rm -f "$DATA_DISK" "$SERIAL_LOG"
+    [ -n "$KUBECONFIG_FILE" ] && rm -f "$KUBECONFIG_FILE"
     [ -n "$EXTRACT_DIR" ] && rm -rf "$EXTRACT_DIR"
 }
 trap cleanup EXIT
@@ -35,7 +39,7 @@ extract_kernel_from_iso "$ISO" "$EXTRACT_DIR"
 KVM_FLAG=$(detect_kvm)
 [ -n "$KVM_FLAG" ] && echo "    KVM acceleration: enabled"
 
-# Launch QEMU with API port forwarded
+# Launch QEMU with API + kubeconfig ports forwarded
 # shellcheck disable=SC2086
 qemu-system-x86_64 \
     -m 2048 -smp 2 \
@@ -45,34 +49,29 @@ qemu-system-x86_64 \
     -initrd "$INITRAMFS" \
     -drive "file=$DATA_DISK,format=raw,if=virtio" \
     -net "nic,model=virtio" \
-    -net "user,hostfwd=tcp::${API_PORT}-:6443" \
-    -append "console=ttyS0,115200n8 kubesolo.data=/dev/vda" \
+    -net "user,hostfwd=tcp::${API_PORT}-:6443,hostfwd=tcp::${KC_PORT}-:8080" \
+    -serial "file:$SERIAL_LOG" \
+    -append "console=ttyS0,115200n8 kubesolo.data=/dev/vda kubesolo.debug" \
     &
 QEMU_PID=$!
 
-# Wait for API server
-echo "    Waiting for K8s API on localhost:${API_PORT}..."
+# Wait for boot
+echo "    Waiting for boot..."
+wait_for_boot "$SERIAL_LOG" "$QEMU_PID" 180 || exit 1
+
+# Fetch kubeconfig
+KUBECONFIG_FILE=$(mktemp /tmp/kubesolo-kubeconfig-XXXXXX.yaml)
+fetch_kubeconfig "$KC_PORT" "$KUBECONFIG_FILE" || exit 1
+
+# Wait for K8s node to reach Ready
+echo "    Waiting for K8s node Ready..."
 ELAPSED=0
 while [ "$ELAPSED" -lt "$TIMEOUT_K8S" ]; do
-    if kubectl --kubeconfig=/dev/null \
-        --server="https://localhost:${API_PORT}" \
+    if kubectl --kubeconfig="$KUBECONFIG_FILE" \
         --insecure-skip-tls-verify \
         get nodes 2>/dev/null | grep -q "Ready"; then
         echo ""
-        echo "==> PASS: K8s node is Ready (${ELAPSED}s)"
-
-        # Bonus: try deploying a pod
-        echo "    Deploying test pod..."
-        kubectl --server="https://localhost:${API_PORT}" --insecure-skip-tls-verify \
-            run test-nginx --image=nginx:alpine --restart=Never 2>/dev/null || true
-
-        sleep 10
-        if kubectl --server="https://localhost:${API_PORT}" --insecure-skip-tls-verify \
-            get pod test-nginx 2>/dev/null | grep -q "Running"; then
-            echo "==> PASS: Test pod is Running"
-        else
-            echo "==> WARN: Test pod not Running (may need more time or image pull)"
-        fi
+        echo "==> PASS: K8s node is Ready (${ELAPSED}s after boot)"
         exit 0
     fi
     sleep 5
@@ -82,4 +81,6 @@ done
 
 echo ""
 echo "==> FAIL: K8s node did not reach Ready within ${TIMEOUT_K8S}s"
+echo "    Last 40 lines of serial log:"
+tail -40 "$SERIAL_LOG" 2>/dev/null
 exit 1