Spoke cluster end-to-end validation

**Parent:** #584
**Priority:** Medium

Validate the full spoke lifecycle:
- PlatformCluster composition creates EKS cluster
- Secrets Manager seeding
- Fleet member registration (`fleet/members/{name}/values.yaml` with explicit `clusterName`)
- Addon deployment including pod identities via additionalResources
- PostSync restart hook on spoke
- Destroy/cleanup of spoke resources

**Acceptance criteria:**
- Document exact steps for spoke provisioning
- Validate LBC and external-dns pod identities work on spoke clusters
- Validate PostSync restart hook works on spoke clusters
- Validate destroy removes spoke resources cleanly

Start with parent issue #584 and the spoke configuration at fleet/members/{name}/values.yaml, confirming that clusterName is explicit. Run the full lifecycle from PlatformCluster composition through Secrets Manager seeding, addon deployment, pod identity checks, the PostSync restart hook, and cleanup. Done means the provisioning steps are documented and all listed acceptance criteria pass.

Written by the indexing model from the issue text.