Move CI/CD kubeconfig lessons to k3s-infra skill, remove from MEMORY.md

MEMORY.md

@@ -30,13 +30,6 @@
 - **Note**: Deployment patches to system components (CoreDNS, CNPG operator) are runtime changes. Document in infra notes so they can be re-applied if needed.
 - **Note**: CNPG Pooler CRD supports `spec.template.spec.affinity` but requires `containers` field too (name+image of pgbouncer)
 
-## CI/CD Kubeconfig Lessons
-- **Always use the PUBLIC IP** (188.34.201.101:6443) in deployer kubeconfigs — CI runners run externally and can't reach private IPs (10.0.1.5)
-- **Kubeconfig for Forgejo must be base64-encoded** — the workflow does `base64 -d` before use
-- **Use `kubectl config` commands** to build kubeconfig (not heredoc interpolation) — avoids CA cert corruption
-- **Each deployer SA needs cross-namespace RoleBinding** — staging SA needs binding in prod namespace and vice versa
-- **Never read kubeconfig contents** — generate on k3s-mgr, base64 encode, scp to /tmp, let user paste into Forgejo
-
 ## Game Save Files
 - `memory/d2r.json` — Diablo II: Resurrected progress (Necro "Baltasar", Summoner build)
 - `memory/bg3.json` — Baldur's Gate 3 progress (Act 1, level 3)