lab1: 2 GiB workers, CAPMOX memory overcommit, CA install (Step 6), future-tasks

Owner's pending work, committed ahead of the pv1-2 change it underlies:
- lab1.yaml: worker template lab1-worker-2g (2048 MiB, decision #16), MD rollout
  maxSurge 0 / maxUnavailable 1, ProxmoxCluster schedulerHints.memoryAdjustment 160 (#17)
- cluster-autoscaler values: RBAC for proxmoxmachinetemplates, aggressive scale-down
  profile, Cilium startup-taint; runbook Steps 4-7 and troubleshooting rows
- inflate test pods 512Mi; decisions #16/#17; session note on the memory overcommit
- docs/future-tasks.md convention (CLAUDE.md, README) with the namespace-per-cluster task
- AGENTS.md; allowlist entries in .claude/settings.json

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

configs/test/inflate.yaml

@@ -1,6 +1,6 @@
 # apply to the workload cluster; scale replicas to trigger scale-up
-# 2 pods per 4 vCPU / 4 GiB worker: CPU-bound (2 × 1500m); 1Gi keeps memory from binding first
-# (a 4 GiB node has ~3.3–3.6 GiB allocatable, which would fit only one 2Gi pod)
+# 2 pods per 4 vCPU / 2 GiB worker: CPU-bound (3 × 1500m > 4000m); 512Mi keeps memory from binding
+# first (a 2 GiB VM has ~1.78 GiB allocatable; measured 3.73 GiB on a 4 GiB VM)
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -17,4 +17,4 @@ spec:
         - name: pause
           image: registry.k8s.io/pause:3.10
           resources:
-            requests: { cpu: "1500m", memory: "1Gi" }
+            requests: { cpu: "1500m", memory: "512Mi" }