Investigate containers and clusters

What this does

One skill, three investigation modes over container/Kubernetes data in the SubImage graph:

• Mode 1: Image provenance: given an image URI / tag / digest, resolve the full chain: registry repository → running workloads (Container → Pod → Service, and Functions) → source repo (PACKAGED_FROM) → vulnerabilities.
• Mode 2: Cluster exposure: given a cluster name, enumerate the internet-facing surface: LoadBalancer/NodePort services, ingress, public-IP nodes, and everything flagged exposed_internet=true.
• Mode 3: Node reconciliation: when EKS node counts look inflated, separate running EC2 instances from terminated/stopped ones still linked by MEMBER_OF_EKS_CLUSTER.

When to use

✅ User pastes an image reference and asks where it runs / what's wrong with it → Mode 1. ✅ "What's exposed in cluster X?" / "audit the attack surface of this EKS cluster" → Mode 2. ✅ "The chatbot says cluster X has N nodes but kubectl shows fewer" → Mode 3.

❌ A single CVE across the whole environment → subimage-mcp:investigate-cve. ❌ An attack path from a workload → subimage-mcp:review-attack-path. ❌ Ambiguous which mode: ask the user which of the three they want before running.