V3 kubectl CLI capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local kubectl CLI ingredient exposes bounded Kubernetes developer operations for client readiness, local kubeconfig inspection, and local Kustomize rendering. Client/config operations do not contact a Kubernetes API server; the redacted config view deliberately uses --raw=false and approval=ask because even non-raw kubeconfig metadata can reveal local cluster and user names. Project operations run from an explicit project directory cwd supplied at execution time, accept only a trusted relative kustomization directory, avoid caller-supplied kubectl flags, avoid shell wrappers, and never expose apply, diff, delete, get, exec, logs, port-forward, rollout, live cluster reads/writes, raw kubeconfig secrets, caller-supplied kubeconfig/context/namespace, output-file writes, alpha plugins, Helm inflator enablement, function network mode, function mounts, environment override, or arbitrary command execution. Kustomize render output and diagnostics are returned as inspectable text. Requires kubectl on PATH.