lab1: 2 GiB workers, CAPMOX memory overcommit, CA install (Step 6), future-tasks

Owner's pending work, committed ahead of the pv1-2 change it underlies:
- lab1.yaml: worker template lab1-worker-2g (2048 MiB, decision #16), MD rollout
  maxSurge 0 / maxUnavailable 1, ProxmoxCluster schedulerHints.memoryAdjustment 160 (#17)
- cluster-autoscaler values: RBAC for proxmoxmachinetemplates, aggressive scale-down
  profile, Cilium startup-taint; runbook Steps 4-7 and troubleshooting rows
- inflate test pods 512Mi; decisions #16/#17; session note on the memory overcommit
- docs/future-tasks.md convention (CLAUDE.md, README) with the namespace-per-cluster task
- AGENTS.md; allowlist entries in .claude/settings.json

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -82,6 +82,7 @@ Phases 2 and 3 are independent and can be done in either order.
 │   └── cluster-inspector/        # RBAC, kubeconfig minting script, gitignored kubeconfigs/
 ├── docs/
 │   ├── decisions.md              # decision log: alternatives, why, status
+│   ├── future-tasks.md           # deferred work with context, newest first
 │   ├── plans/                    # plans (plan mode), one file per plan
 │   ├── plans-executions/         # per-plan execution logs with exact commands
 │   ├── sessions/                 # research/design conversation summaries