fix: collapse GPU Service menu in Personal Org; add K8s-direct CTA

Two follow-ups to the GPU Service gating:

- In Personal-Org view the access extension was stripping
  canSeeAdmin/canSeeOrgAdmin but leaving canSeeGpuService at its
  admin-shortcut value, so platform admins switched into Personal
  still saw the menu even though Personal scope can't host a K8s
  cluster. Mirror the probe result through sessionStorage so the
  extension can fall back to the strict cluster-availability signal
  in that branch.

- The empty-state CTA now reads 'Add a Kubernetes Cluster' and, on
  click, opens the cluster-create flow with Kubernetes preselected
  via clusterSession.providerHint. ClusterCreate consumes the hint
  on mount: it seeds extraData.provider and starts at the configure
  step instead of the provider catalog, so the user lands one click
  closer to the form they actually need.

src/atoms/clusters.ts

@@ -63,6 +63,12 @@ export const fromClusterCreationAtom = atom(false);
 export const clusterSessionAtom = atom<{
   firstAddWorker: boolean;
   firstAddCluster: boolean;
+  // Provider to preselect when the create flow opens — set by the
+  // empty-state CTA on feature pages that need a specific provider
+  // (e.g. GPU Service can only schedule on Kubernetes, so its
+  // "Add Cluster" button skips provider catalog and lands on the
+  // K8s configure step). Consumed once by ClusterCreate on mount.
+  providerHint?: string;
 } | null>(null);
 
 export const clusterDetailAtom = atom<ClusterListItem | null>(null);