lab1: 2 GiB workers, CAPMOX memory overcommit, CA install (Step 6), future-tasks

Owner's pending work, committed ahead of the pv1-2 change it underlies:
- lab1.yaml: worker template lab1-worker-2g (2048 MiB, decision #16), MD rollout
  maxSurge 0 / maxUnavailable 1, ProxmoxCluster schedulerHints.memoryAdjustment 160 (#17)
- cluster-autoscaler values: RBAC for proxmoxmachinetemplates, aggressive scale-down
  profile, Cilium startup-taint; runbook Steps 4-7 and troubleshooting rows
- inflate test pods 512Mi; decisions #16/#17; session note on the memory overcommit
- docs/future-tasks.md convention (CLAUDE.md, README) with the namespace-per-cluster task
- AGENTS.md; allowlist entries in .claude/settings.json

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

configs/cluster-autoscaler/values.yaml

@@ -1,4 +1,4 @@
-# helm install ca autoscaler/cluster-autoscaler --version 9.59.0 -n default -f values.yaml
+# helm upgrade --install ca cluster-autoscaler --repo https://kubernetes.github.io/autoscaler --version 9.59.0 -n default -f values.yaml
 # must be installed in the same namespace as the <cluster>-kubeconfig secret
 cloudProvider: clusterapi
 clusterAPIMode: kubeconfig-incluster      # workload via kubeconfig, management in-cluster
@@ -8,10 +8,26 @@ autoDiscovery:
   namespace: default
 image:
   tag: v1.35.2                            # chart default appVersion is 1.35.0
+rbac:
+  # CA reads the infrastructure machine template (capacity for scale-from-zero). The chart's
+  # ClusterRole only covers cluster.x-k8s.io; without this the first main loop blocks forever on
+  # "waiting for cache sync on infrastructure resource" and CA never scales.
+  additionalRules:
+    - apiGroups: [infrastructure.cluster.x-k8s.io]
+      resources: [proxmoxmachinetemplates]
+      verbs: [get, list, watch]
 extraArgs:
   expander: least-waste
-  scale-down-unneeded-time: 5m
-  scale-down-delay-after-add: 5m
-  scale-down-utilization-threshold: "0.5"
+  # Aggressive lab scale-down profile (CA 1.35 defaults in brackets): idle worker gone in ~3 min.
+  # Keep delay-after-add >= node startup (~2-3 min here) or bursts flap up/down.
+  scale-down-unneeded-time: 1m                # [10m]
+  scale-down-delay-after-add: 2m              # [10m] cluster-wide cooldown after any scale-up
+  scale-down-delay-after-failure: 1m          # [3m]
+  unremovable-node-recheck-timeout: 1m        # [5m]
+  scale-down-utilization-threshold: "0.6"     # [0.5]
+  max-graceful-termination-sec: "60"          # [600] drain wait per pod
   balance-similar-node-groups: true
+  # Cilium taints new nodes NoSchedule until its agent is up. Without this, CA simulates the freshly
+  # registered (still tainted) node, finds the pending pods don't fit and adds one node too many.
+  startup-taint: node.cilium.io/agent-not-ready
   v: 4