F4: AI Diagnosis Layer — Read-Only

## Summary
General, read-only diagnosis across the full range of infrastructure failures. The agent has K8s-level read access (logs, events, service/ingress config, port bindings, resource state) and reasons broadly: OOM, crash-loops, misconfigured ports, wrong service selectors, gateway/ingress routing, DNS, missing env vars, and unenumerated cases.

## Acceptance Criteria
- [ ] K8s read access: logs, events, service/ingress config, port bindings, resource state
- [ ] Diagnosis covers: OOM, crash-loops, port misconfig, service selectors, gateway/ingress routing, DNS, missing env vars
- [ ] Sealos-native knowledge (our networking/gateway model)
- [ ] Soft-launched to beta cohort in Sprint 4
- [ ] Rolled out to all users in Sprint 5
- [ ] Inspection reports generated (what was checked, what was found)

## Architecture
- Read-only — a wrong guess costs nothing
- General by design — not a narrow rules engine
- Sealos-native: outperforms generic coding assistants debugging blind

## Success Metrics
- Diagnosis coverage and accuracy across issue types
- Recommendation acceptance rate
- Inspection report engagement rate

No files, tests, or entry points are identified in the issue. Start by locating the agent diagnosis entry point and the Kubernetes read-access integration, then define how inspection reports and the listed failure cases are represented; done means read-only diagnosis is validated against those cases and the beta and rollout criteria are met.

Written by the indexing model from the issue text.