Add minikube health checks to indri-services-check

Step 0.11 implementation:
- Check minikube status via SSH to indri
- Check k8s API server accessible from indri
- Check k8s API server accessible remotely from gilbert (via 1Password creds)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

mise-tasks/indri-services-check

@@ -75,6 +75,12 @@ check_service "PostgreSQL" "ssh indri '/opt/homebrew/opt/postgresql@18/bin/pg_is
 check_http "Zot Registry" "https://registry.tail8d86e.ts.net/v2/_catalog"
 check_service "Zot metrics file" "ssh indri 'test -f /opt/homebrew/var/node_exporter/textfile/zot.prom'"
 
+echo ""
+echo "Kubernetes cluster:"
+check_service "minikube" "ssh indri 'minikube status --format={{.Host}} | grep -q Running'"
+check_service "k8s-apiserver (indri)" "ssh indri 'kubectl get --raw /healthz'"
+check_service "k8s-apiserver (remote)" "kubectl --kubeconfig=$HOME/.kube/minikube-indri/config.yml --context=minikube-indri get --raw /healthz"
+
 echo ""
 if [ $FAILED -eq 0 ]; then
     echo -e "${GREEN}All services healthy!${NC}"

plans/k8s-migration.md

@@ -742,6 +742,10 @@ mise run indri-services-check
 # k8s-apiserver...     OK
 ```
 
+**Implementation Notes:**
+- Added a third check `k8s-apiserver (remote)` that verifies kubectl access from gilbert, not just via SSH to indri. This ensures the 1Password credential flow and remote API server access are working.
+- The remote check uses both `--kubeconfig` and `--context` flags explicitly since the script runs in bash (not fish) and doesn't inherit the KUBECONFIG environment variable from fish config.
+
 ---
 
 ### Step 0.12: Create Zettelkasten Documentation