lab1 workers on both PVE nodes: per-node template + MD, balanced CA

PVE is now the 2-node cluster homelab (pv1-1 + pv1-2), no shared storage:
- template 101 copied to pv1-2 as 9101; MDs lab1-workers-pv1-1 (max 6) and
  lab1-workers-pv1-2 (max 12), PMTs pinned with allowedNodes; pool .31-.50;
  lab1-workers renamed for symmetry (decision #18, #7 superseded)
- CA: balancing-label node.cluster.x-k8s.io/pool (+ pool label, capacity labels
  with os/arch, maxPods on the MDs), scan-interval 1m, v 2, default QPS (#19).
  Scale test: 16 pods -> 4 + 4 across both nodes.
- runbook, image-builder copy procedure, fixes tables, future task to report
  three CA clusterapi bugs upstream, lab facts, changelog, execution log

Plan: docs/plans/2026-09-29-2315-pv1-2-workers.md

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/image-builder-proxmox.md

@@ -2,7 +2,8 @@
 
 Result: Proxmox template `ubuntu-2404-kube-v1.35.9` on node `pv1-1` — Ubuntu 24.04.4, containerd,
 kubeadm/kubelet/kubectl v1.35.9, pre-pulled control-plane images, cloud-init, qemu-guest-agent.
-Its VMID is `TEMPLATE_VMID` for CAPMOX.
+Its VMID (101) is `TEMPLATE_VMID` for CAPMOX. A byte-identical copy, 9101, sits on `pv1-2`
+([Template on other PVE nodes](#template-on-other-pve-nodes)).
 
 ## Build host prerequisites (Ubuntu 24.04)
 
@@ -88,3 +89,28 @@ qm stop $ID && qm destroy $ID --purge
 ```
 
 kubelet crash-looping before `kubeadm init/join` is expected.
+
+## Template on other PVE nodes
+
+Without shared storage, a template on `local-lvm` can only be cloned on its own node. That holds
+for PVE and for CAPMOX: `can't clone VM to node '<target>' (VM uses local storage)`. Each additional
+PVE node therefore gets its own copy under its own VMID, since VMIDs are cluster-wide.
+
+Copy rather than rebuild: the copy is byte-identical, whereas a second Packer run would pick up
+newer apt packages. The source must have no disk or CD-ROM on non-shared storage other than
+`local-lvm`; check with `qm config 101`.
+
+```bash
+# on the node holding the template (pv1-1); 9101 = copy for pv1-2
+qm clone 101 9101 --full 1 --name ubuntu-2404-kube-v1.35.9 --storage local-lvm  # clone stays on pv1-1
+qm migrate 9101 pv1-2 --with-local-disks                                        # offline: copies the LVs
+ssh root@192.168.0.10 qm template 9101
+```
+
+Then run the smoke test on the target node with `TPL=9101`. It also proves that VLAN 4 works on
+that node's `vmbr0`. The copy is referenced by `templateID: 9101` + `sourceNode: pv1-2` in that
+node's `ProxmoxMachineTemplate`
+([phase 1, Step 0](phase-1-proxmox-capi.md#step-0--proxmox-prep)).
+
+A new template build (a new Kubernetes version) means building on `pv1-1` and then repeating the
+copy for every other node, with a new VMID pair per version.