Kubernetes v1.36: Fine-Grained Kubelet Authorization Just Killed nodes/proxy

Kubernetes v1.36 'Haru' ships fine-grained kubelet API authorization as GA, retiring the overly broad nodes/proxy grant that quietly allowed RCE on every node. Here is what changed, why it matters, and how to migrate your monitoring DaemonSets to least privilege.