Add headlamp/headlamp.yaml (Deployment v0.42.0, cluster-admin ServiceAccount + login token, Service, Traefik ingress). Remove the stray root headlamp-ingress.yaml that referenced a non-existent service. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>