Auditable AI-assisted Kubernetes incident remediation via MCP. OPA pre-flight + Kyverno admission + short-lived per-action ServiceAccount tokens. LLM narrates, never decides.

See docs/superpowers/specs/2026-04-22-mcp-k8s-secure-ops-design.md for the full design.