Add an RCA (root-cause-analysis) agent for KubePlus application instances

Add a kagent-compatible AI agent that performs root-cause analysis on failed or degraded KubePlus application instances. Unlike generic Kubernetes troubleshooting agents, this agent's value comes from encoding KubePlus-specific domain knowledge: which resources belong to a single logical instance, common failure patterns across the pods/config that make up an instance, and how to correlate signals across them.

**Motivation:**
KubePlus already tracks the full set of resources (pods, Helm values, related config) belonging to a single application instance — context that's invisible to generic k8s troubleshooting tools operating pod-by-pod.
"Operator-native context sources" — related-pod logs, Helm values.yaml, SaaS platform component logs — only exist as a coherent single-instance view because KubePlus's CRD model ties them together. An RCA agent is the natural way to put that context to work.

**Proposed scope (v1):**
Declarative kagent Agent resource with a system prompt encoding:
- How to interpret KubePlus CRD status/conditions
- Which related resources (per the MCP server's resource-composition tool) are typically relevant to check when an instance shows degraded/failed state
- How to correlate Helm values.yaml changes with instance failures (e.g. a bad config value causing a specific pod's CrashLoopBackOff)

Tools consumed: the mcp-server/ tools from Issue #[MCP server issue] (metrics, related-resources lookup, instance describe), plus standard kagent built-in k8s tools (pod logs, describe) as needed.
Initial evaluation: a small set of induced failure scenarios (bad Helm value, resource-quota exhaustion, misconfigured network policy) to validate the agent correctly identifies root cause versus just symptoms.

**Out of scope for v1:**
Automated remediation (the agent diagnoses; it doesn't act) — this keeps blast radius to zero for an early-stage agent.
Cross-instance/cross-tenant correlation — v1 scope is single-instance RCA only.

**Location:**
agents/rca-agent/ in this repo, following the same directory convention proposed for the MCP server.

Depends on: #1477

Start by reading the MCP server work in #1477 and inspect the agents/rca-agent/ convention once that dependency is available. Define a declarative kagent Agent with KubePlus-specific RCA guidance and the listed tools, then validate it against induced bad Helm value, resource-quota, and network-policy failures without enabling remediation.

Written by the indexing model from the issue text.