the published surface, on a fresh root

This repository is now the public half of a split: six documents saying what to
decide, and one gap. How the cluster is built moved to jeffry/homelab-impl, which
is private because its README is an inventory of chart versions and image tags.

History starts here deliberately, and not as tidiness. The previous history
contained that inventory, and this repository is public — a deletion commit would
have removed it from the tree and left it in the log. A fresh root can only carry
what is in it.

Two pointers rewritten rather than deleted: private-access.md and .loom/README.md
both directed a reader to TAILSCALE.md and README.md at the root, which are now
private. They now say a fuller reference exists, that it is private, and how to
ask — because a public page naming a private thing as its answer is the failure
this project has now hit four times.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -0,0 +1,25 @@
+# homelab-cluster
+
+**What a three-node k3s cluster on a home LAN offers, for somebody deciding
+whether to put something on it.**
+
+**Six documents in [`.loom/published/`](.loom/published/)** — *and one thing we
+need and cannot find, in [`.loom/gaps/`](.loom/gaps/).*
+
+**Start with [`.loom/README.md`](.loom/README.md).**
+
+---
+
+## What is not here
+
+**How the cluster is built.** *Manifests, Helm values, the rebuild guide, the
+inventory of what is running and at which version.* **That is
+`jeffry/homelab-impl` and it is private**, because a version inventory is a target
+list for anybody matching published vulnerabilities.
+
+> **Nothing on this side links to that side.** *A public page naming a private
+> thing as its answer costs the reader a request and their confidence in the rest
+> of the page.*
+
+**Each document here ends with how to check it is still true.** *Nothing serves
+the truth about a running cluster, so the only mechanism is somebody looking.*