chore: move source to repo root and standardize config

Phase 1 — Structural overhaul:
- Move all source from headlamp-sealed-secrets/ subdirectory to repo root
- Delete 23 AI-generated docs, 8 pre-built tarballs, release snapshots dir
- Remove all working-directory refs from CI/release workflows
- Update install-plugin.sh and typedoc.json paths

Phase 2 — Config standardization:
- Create .eslintrc.js and .prettierrc.js (standard Headlamp configs)
- Remove inline eslintConfig/prettier from package.json (drop jsx-a11y, prettier extends)
- Rewrite tsconfig.json (package name extend, add compilerOptions.types)
- Create vitest.config.mts and vitest.setup.ts (standard from polaris)
- Replace headlamp-plugin CLI scripts with direct tool invocation
- Rewrite .gitignore with standard baseline

Phase 3 — MCP & Claude settings:
- Create .mcp.json with github/kubernetes/flux/playwright servers
- Create .claude/settings.local.json
- Remove 7 specialized agents, keep 3 meta-orchestration agents

Phase 4 — Documentation:
- Rewrite CLAUDE.md (remove subdirectory refs, standard format)
- Add ArtifactHub badge, Architecture section, standardized install methods to README.md
- Create CONTRIBUTING.md and SECURITY.md
- Fix pre-existing test bugs in validators.test.ts (isValidNamespace returns boolean,
  not ValidationResult; error message string mismatches)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/ci.yaml

@@ -20,32 +20,26 @@ jobs:
         with:
           node-version: '20'
           cache: 'npm'
-          cache-dependency-path: headlamp-sealed-secrets/package-lock.json
 
       - name: Install dependencies
-        working-directory: ./headlamp-sealed-secrets
         run: npm ci
 
       - name: Type-check
-        working-directory: ./headlamp-sealed-secrets
         run: npm run tsc
 
       - name: Lint
-        working-directory: ./headlamp-sealed-secrets
         run: npm run lint
 
       - name: Build plugin
-        working-directory: ./headlamp-sealed-secrets
         run: npx @kinvolk/headlamp-plugin build
 
       - name: Verify build artifacts
-        working-directory: ./headlamp-sealed-secrets
         run: |
           if [ ! -d "dist" ] || [ -z "$(ls -A dist)" ]; then
             echo "::error::dist directory is empty or missing"
             exit 1
           fi
-          echo "✓ Build artifacts verified"
+          echo "Build artifacts verified"
           ls -lh dist/
 
       - name: Upload build artifact (for inspection)
@@ -53,5 +47,5 @@ jobs:
         if: always()
         with:
           name: plugin-dist
-          path: headlamp-sealed-secrets/dist/
+          path: dist/
           retention-days: 7

.github/workflows/release.yaml

@@ -26,7 +26,6 @@ jobs:
 
       - name: Get package name
         id: package_name
-        working-directory: ./headlamp-sealed-secrets
         run: |
           PKG_NAME=$(jq -r '.name' package.json)
           echo "name=${PKG_NAME}" >> $GITHUB_OUTPUT
@@ -38,7 +37,6 @@ jobs:
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
       - name: Update package.json version
-        working-directory: ./headlamp-sealed-secrets
         run: |
           jq --arg version "${{ inputs.version }}" '.version = $version' package.json > package.json.tmp
           mv package.json.tmp package.json
@@ -57,40 +55,22 @@ jobs:
         with:
           node-version: '20'
           cache: 'npm'
-          cache-dependency-path: headlamp-sealed-secrets/package-lock.json
 
       - name: Install dependencies
-        working-directory: ./headlamp-sealed-secrets
         run: npm ci
 
       - name: Run type check
-        working-directory: ./headlamp-sealed-secrets
         run: npm run tsc
 
       - name: Run linter
-        working-directory: ./headlamp-sealed-secrets
         run: npm run lint
 
       - name: Build plugin
-        working-directory: ./headlamp-sealed-secrets
         run: npx @kinvolk/headlamp-plugin build
 
       - name: Package plugin
-        working-directory: ./headlamp-sealed-secrets
         run: npx @kinvolk/headlamp-plugin package
 
-      - name: Move tarball to root
-        working-directory: ./headlamp-sealed-secrets
-        run: |
-          TARBALL="${{ steps.package_name.outputs.name }}-${{ inputs.version }}.tar.gz"
-          if [ ! -f "${TARBALL}" ]; then
-            echo "::error::Expected tarball ${TARBALL} not found"
-            ls -la *.tar.gz
-            exit 1
-          fi
-          mv "${TARBALL}" "../${TARBALL}"
-          echo "Moved tarball: ${TARBALL}"
-
       - name: Validate tarball name
         run: |
           EXPECTED="${{ steps.package_name.outputs.name }}-${{ inputs.version }}.tar.gz"
@@ -99,7 +79,7 @@ jobs:
             echo "::error::Tarball name mismatch! Expected: $EXPECTED, Got: $ACTUAL"
             exit 1
           fi
-          echo "✓ Tarball name validated: $ACTUAL"
+          echo "Tarball name validated: $ACTUAL"
 
       - name: Compute checksum
         id: compute_checksum
@@ -120,7 +100,7 @@ jobs:
             echo "::error::main.js not found in tarball"
             exit 1
           fi
-          echo "✓ Tarball contents validated"
+          echo "Tarball contents validated"
 
       - name: Update checksum in metadata
         run: |
@@ -129,7 +109,7 @@ jobs:
 
       - name: Commit version bump and metadata
         run: |
-          git add headlamp-sealed-secrets/package.json artifacthub-pkg.yml
+          git add package.json artifacthub-pkg.yml
           git commit -m "chore: release v${{ inputs.version }}"
           git push origin main
 
@@ -159,9 +139,9 @@ jobs:
           echo "Checksum: sha256:${{ steps.compute_checksum.outputs.checksum }}"
           echo "Archive URL: https://github.com/${{ github.repository }}/releases/download/v${{ inputs.version }}/${{ steps.package_name.outputs.name }}-${{ inputs.version }}.tar.gz"
           echo ""
-          echo "✓ Version bumped to ${{ inputs.version }}"
-          echo "✓ Metadata updated with checksum"
-          echo "✓ Tag v${{ inputs.version }} created"
-          echo "✓ GitHub release published with tarball"
+          echo "Version bumped to ${{ inputs.version }}"
+          echo "Metadata updated with checksum"
+          echo "Tag v${{ inputs.version }} created"
+          echo "GitHub release published with tarball"
           echo ""
           echo "Artifact Hub will sync within 5-10 minutes."