[home] Create explicit kubectl role

This allows work machines to enable development, while not including
non-work-related kubectl management stuffs.

home/roles/default.nix

@@ -6,6 +6,7 @@
     ./development
     ./gaming
     ./kdeconnect
+    ./kubectl
     ./media
     ./office
     ./sync

home/roles/development/default.nix

@@ -30,8 +30,6 @@ in
       pkgs.custom.tea-rbw
     ];
 
-    programs.kubectl-secure.enable = true;
-
     # Install Claude Code humanlayer command and agent plugins
     home.activation.claudeCodeCommands = lib.hm.dag.entryAfter ["writeBoundary"] ''
       # Clean up old plugin-installed commands and agents to avoid duplicates

home/roles/kubectl/default.nix

@@ -0,0 +1,16 @@
+{ config, lib, pkgs, globalInputs, system, ... }:
+
+with lib;
+
+let
+  cfg = config.home.roles.kubectl;
+in
+{
+  options.home.roles.kubectl = {
+    enable = mkEnableOption "Enable management tools for the homelab k3s oglenet cluster";
+  };
+
+  config = mkIf cfg.enable {
+    programs.kubectl-secure.enable = true;
+  };
+}