One change: a shared kubehz space gets its kubectl kubeconfig from lo provision. Nothing else moved, and no command changed its piped output for the cases the parity harnesses diff.

Added

• lo provision for spec.kubehz.hosting: shared writes .kubeconfig/<domain>.yaml once the space is Active (D30). The file comes from the kubehz api: the space's public endpoint (a publicly trusted certificate, so no CA travels), a kubectl oidc-login exec stanza for the shard's sign-in client, and the context kubehz-<slug> scoped to the space's namespace. It holds no credential: the first kubectl --context kubehz-<slug> opens your browser at the kubehz sign-in. The provision output names the context and the file.
• lo kubeconfig on a space prints that path once the file exists. Before it, and against an api without the route, the command explains space access as it did.
• lo destroy on a space removes the file, as the hosted path does.

Both implementations carry the change; the bash tree gained two bats cases and the Go side two hermetic tests.

Requires

kubehz-api with GET /api/spaces/{id}/kubeconfig (kubehz-api #127). An older api answers 404 and lo provision keeps the older access lines.