fix(canary-phase6): address audit nit before rollup

Phase 6 audit (2 agents in parallel) returned PASS. The
general-purpose spec-adherence agent flagged one actionable NIT (the
superpowers:code-reviewer flagged the same item as defensible — fixing
it per the fix-in-phase rule regardless).

N1 — template.yaml.tmpl line 2 file-header comment read
"# template.yaml" but the on-disk filename is template.yaml.tmpl
(renamed in commit 6f994f37 to avoid the repo's check-yaml pre-commit
hook). Project file-header rule is "©AngelaMos | 2026 + filename only
(NOT path)" — the comment must match the actual filename. Updated to
"# template.yaml.tmpl".

Other audit observations marked NOT-ACTIONABLE:
- NIT (verb table): verbFromMethod handles GET/POST/PUT/PATCH/DELETE
  + default-to-list. OPTIONS/CONNECT/TRACE fall through to "list"
  which is the sanctioned ceiling per the verb-derivation enhancement
  scope. Phase 14 may revisit if scan-OPTIONS forensics matters.
- NIT (defaultResource stutter): "resource is forbidden: ... cannot
  list resource resource ..." for empty-path edge cases. Real kubectl
  never emits an empty path; cosmetic only.
- NIT (empty baseURL): TrimRight on empty string produces empty +
  "/k/" + id which is relative. Registry wire-up guarantees non-empty
  baseURL; defensive guard would be belt-and-suspenders only.
- INFO (Bearer extraction): plan task 6.2 mentions "extracts Bearer
  (or path id)" — Phase 6's generator receives *token.Token
  already-resolved per the §6.2 Generator interface, so the path/Bearer
  dispatch lands at the routing layer in Phase 9. Phase 6 punt is
  legitimate.
- POSITIVE observations from both agents are retained as-is.

Pre-rollup gate clean: go build / vet / test -race / test -tags=
integration / golangci-lint run all pass.

PROJECTS/beginner/canary-token-generator/backend/internal/token/generators/kubeconfig/template.yaml.tmpl

@@ -1,5 +1,5 @@
 # ©AngelaMos | 2026
-# template.yaml
+# template.yaml.tmpl
 apiVersion: v1
 kind: Config
 current-context: {{.ClusterName}}