Building a Production-Grade Vault PKI for a Local kubeadm Cluster Without the Shortcuts.

Previously in Part 2: Cluster 1- the OrbStack-native daily driver is up with Istio, Vault dev mode, and Crossplane. Now we start the harder half: a four-VM kubeadm cluster that mirrors a real producti