feat: add -s/--shell flag for scoped sub-shell

Spawns an isolated sub-shell with a minimal kubeconfig containing only
the specified context. Inside the shell, all operations (switch,
rename, delete, unset, list, current, and interactive modes) are blocked
via the KUBECTX_ISOLATED_SHELL env var. Only help and version remain
allowed. Nested scoped shells are also prevented.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/dependabot.yml

@@ -1,21 +0,0 @@
-version: 2
-updates:
-- package-ecosystem: github-actions
-  directory: /
-  schedule:
-    interval: weekly
-  commit-message:
-    prefix: chore
-    include: scope
-
-- package-ecosystem: gomod
-  directory: /
-  schedule:
-    interval: weekly
-  commit-message:
-    prefix: chore
-    include: scope
-  groups:
-    kubernetes:
-      patterns:
-        - "k8s.io/*"

.github/workflows/dependabot.yml

@@ -1,24 +0,0 @@
-name: Dependabot
-
-on:
-  pull_request:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  auto-merge:
-    runs-on: ubuntu-latest
-    if: ${{ github.actor == 'dependabot[bot]' }}
-    steps:
-    - name: Dependabot metadata
-      id: metadata
-      uses: dependabot/fetch-metadata@v2
-
-    - name: Enable auto-merge for Dependabot PRs
-      if: ${{ steps.metadata.outputs.update-type != 'version-update:semver-major' }}
-      run: gh pr merge --auto --merge "$PR_URL"
-      env:
-        PR_URL: ${{ github.event.pull_request.html_url }}
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}