Spoke cluster end-to-end validation

[punkwalker]

Parent: #584
Priority: Medium

Validate the full spoke lifecycle:

• PlatformCluster composition creates EKS cluster
• Secrets Manager seeding
• Fleet member registration (fleet/members/{name}/values.yaml with explicit clusterName)
• Addon deployment including pod identities via additionalResources
• PostSync restart hook on spoke
• Destroy/cleanup of spoke resources

Acceptance criteria:

• Document exact steps for spoke provisioning
• Validate LBC and external-dns pod identities work on spoke clusters
• Validate PostSync restart hook works on spoke clusters
• Validate destroy removes spoke resources cleanly