Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF

- ArgoCD migrated to argocd namespace
- Cert-manager issuers/certs created
- 20 namespaces imported with pod-security labels
- S3 backend temporarily offline (MinIO), using local backup
- Pending: Remove metadata drift from helm releases, re-apply

USAGE.md

@@ -118,6 +118,23 @@ core log-svc <ip> <svc>       # logs for specific service (etcd, kubelet, etc.)
 core pods clean               # delete Failed/Evicted/Terminating pods
 ```
 
+#### kubectl Context (LAN vs. WireGuard)
+
+`cluster-config/kubeconfig` has two contexts pointed at the same cluster:
+`admin@homelab-cluster` (LAN, `192.168.1.213:6443`) and `admin@homelab-cluster-1`
+(WireGuard, `10.6.0.1:6443`). If `kubectl`/`core nodes` hangs or refuses the
+connection, you're likely off-LAN — switch contexts:
+
+```bash
+core config kube-list             # list contexts
+core config kube-use admin@homelab-cluster-1   # switch to WireGuard path
+```
+
+**Known gap:** `core config use <talos-context>` (the combined talosctl+kubectl
+switch) only maps to `admin@homelab-cluster` today — its WireGuard mapping
+(`home-cluster-wire-guard`) is stale, that kubectl context doesn't exist. Use
+`core config kube-use admin@homelab-cluster-1` directly until that's fixed.
+
 ---
 
 ### Secret Management (Vault)
@@ -311,7 +328,7 @@ core get cluster/iam/roles/admin --key roles
 
 ```bash
 # 1. Get ci-bot JWT token (runner has this injected via ServiceAccount)
-export REGISTRY_TOKEN=$(talos get cluster/iam/agents/ci-bot --key token)
+export REGISTRY_TOKEN=$(core get cluster/iam/agents/ci-bot --key token)
 
 # 2. Authenticate docker/podman to Forgejo registry
 docker login forgejo.riotpiao.homelab.com \