lab1: 2 GiB workers, CAPMOX memory overcommit, CA install (Step 6), future-tasks

Owner's pending work, committed ahead of the pv1-2 change it underlies:
- lab1.yaml: worker template lab1-worker-2g (2048 MiB, decision #16), MD rollout
  maxSurge 0 / maxUnavailable 1, ProxmoxCluster schedulerHints.memoryAdjustment 160 (#17)
- cluster-autoscaler values: RBAC for proxmoxmachinetemplates, aggressive scale-down
  profile, Cilium startup-taint; runbook Steps 4-7 and troubleshooting rows
- inflate test pods 512Mi; decisions #16/#17; session note on the memory overcommit
- docs/future-tasks.md convention (CLAUDE.md, README) with the namespace-per-cluster task
- AGENTS.md; allowlist entries in .claude/settings.json

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/future-tasks.md

@@ -0,0 +1,45 @@
+# Future tasks
+
+Deferred work, newest first. When a task is picked up it gets a plan in `docs/plans/`; then tick
+it here and link the plan.
+
+## - [ ] Namespace per workload cluster (`lab1` out of `default`)
+
+**Added:** 2026-09-28 09:29 CEST · **Why deferred:** keep phase 1 moving; `default` works for now.
+
+**Problem.** cluster-autoscaler has to run in the same namespace as the Cluster. The chart mounts
+`clusterAPIKubeconfigSecret` as a Secret volume, which only works within the pod's namespace, and
+`lab1-kubeconfig` lives in the Cluster's namespace. `lab1` is in `default`, so CA would be installed
+into `default` too. That mixes things in `default`, and with more clusters (phase 3) you'd get one
+CA per cluster sitting side by side in `default`.
+
+**Options compared:**
+
+| Option | Verdict |
+| --- | --- |
+| CA in `default` (current Step 6) | works; poor hygiene, doesn't scale to more clusters |
+| CA in its own namespace with a copy of the kubeconfig Secret | rejected: CAPI rewrites `lab1-kubeconfig` when it rotates the client cert, so the copy goes stale and CA silently loses the workload cluster |
+| **One namespace per cluster** (`lab1` holds the CAPI objects, `InClusterIPPool`, kubeconfig Secret and CA) | preferred: the usual CAPI multi-cluster layout, one CA per workload cluster, RBAC and cleanup per namespace, matches phase 3 |
+
+**Cost.** Namespace is immutable on CAPI objects, so `lab1` has to be deleted and recreated. That
+means about 15 minutes of provisioning plus reinstalling Cilium. `clusterctl move` is not an option,
+since it's forbidden with cluster-api-operator. CAPMOX credentials come from the controller's
+global Secret, so a new namespace needs no extra credentials. The cost grows once workloads and
+autoscaler state exist on `lab1`, so do it before the Step 7 results matter, or when creating the
+next cluster.
+
+**Changes:**
+
+- `configs/capi/lab1.yaml`: a `Namespace lab1` object and `metadata.namespace: lab1` on every
+  object, including `InClusterIPPool`.
+- `configs/cluster-autoscaler/values.yaml`: `autoDiscovery.namespace: lab1`; install with `-n lab1`
+  (`helm uninstall ca -n default` first if it was installed in `default`).
+- `ansible/group_vars/all.yml`: `inspector_workload_clusters` entry `{ name: lab1, namespace: lab1 }`.
+- `docs/phase-1-proxmox-capi.md`: Steps 3, 5 and 6 (namespace in commands and log expectations,
+  `MachineDeployment/lab1/lab1-workers`).
+- `.claude/agents/cluster-inspector.md`: the "Where things live" table says CA runs in `default`.
+- `docs/decisions.md`: new row (namespace per workload cluster).
+
+**Run by the owner:** `kubectl delete -f configs/capi/lab1.yaml` (old namespace), wait until the
+VMs are gone, `kubectl apply` the new manifest, Cilium `helm upgrade --install`,
+`ansible-playbook mgmt.yml --tags inspector`, then the CA install into `lab1`.