Verify end-to-end on kind: fix Squid FD-table OOM, make the quickstart in-cluster

Co-Authored-By: Claude <noreply@anthropic.com>

internal/provider/kubernetes/pod_test.go

@@ -72,7 +72,10 @@ func TestBuildPod_usesRequestPort(t *testing.T) {
 func TestSquidConf_permissive(t *testing.T) {
 	t.Parallel()
 	conf := squidConf(3128)
-	for _, want := range []string{"http_port 3128", "http_access allow all", "via off", "forwarded_for off"} {
+	// max_filedescriptors guards against squid sizing its FD tables from a
+	// container's effectively-unlimited RLIMIT_NOFILE and getting OOM-killed
+	// at startup — found by the kind verification run, must not regress.
+	for _, want := range []string{"http_port 3128", "http_access allow all", "via off", "forwarded_for off", "max_filedescriptors 1024"} {
 		if !strings.Contains(conf, want) {
 			t.Errorf("squidConf() = %q, want it to contain %q", conf, want)
 		}