docs(ops): point break-glass at <cluster>-rke2.yaml; split CNPG bucket gap

[surrealwolf]

Small docs/OPS_NOTES.md follow-up to #34 and #35:

• Cluster access: break-glass RKE2 admin kubeconfigs are ~/.kube/<cluster>-rke2.yaml (client certs expire 2027-01-08, poc-apps 2027-09-19; re-fetch after rotation per RKE2_CERT_ROTATION.md), not ~/.kube/<cluster>.yaml.
• Known issues: the "<cluster>.yaml are Rancher-proxied, re-pull them" bullet is now marked resolved. Break-glass lives in <cluster>-rke2.yaml; the <cluster>.yaml files stay Rancher-proxied (rancher-manager.yaml expired) until Terraform's get_kubeconfig overwrites them on the next full apply.
• CNPG: the shared rke2-backups bucket/key is now its own open item (create a cnpg-backups bucket + scoped key in the rustfs console, then update the cnpg-backup-rustfs Secrets and ObjectStore destinationPath). The replica-rebuild and backups bullets already reflect today's resolution.

Docs only; docs/UPGRADE_PLAN.md untouched.

Made with Cursor

[cursor]

Approved. Cursor Bugbot completed successfully and there is no signal of findings that need human review. No approval policy required additional review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}