Phase 1 checkpoint: status/resume doc + cluster helper + toolchain note

Cluster is UP (3/3 Ready, Cilium OK); Phase 1 paused before Flux bootstrap
(Option A: suspend platform/apps until Phase 2). Add infra/PHASE1-STATUS.md
(what's done, state file locations, reconnect steps, remaining T-1.4/1.5,
Phase-2 platform prereq), infra/cluster.sh (status/start/stop/kubeconfig), and
document that tofu+ansible run on the host (libvirt provider limitation).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

infra/devcontainer/README.md

@@ -29,6 +29,18 @@ cd infra/devcontainer
   relabeling it (SELinux hosts).
 - `-v $REPO:/work` and `-v ~/.ssh:/root/.ssh:ro` — the repo and your SSH keys.
 
+## Known limitation — run `tofu` and `ansible` on the HOST, not in the container
+Discovered during Phase 1 bring-up (see `../PHASE1-STATUS.md`):
+- **OpenTofu + `dmacvicar/libvirt`** fails *inside* the container — its read-write `qemu:///system`
+  connect hits a polkit/PID-identity path (`Cannot find start time for pid`) that a mounted socket
+  can't satisfy across the PID namespace (`--pid=host` didn't help). **Run the pinned tofu on the
+  host** (extract once: `podman run --rm -v ~/.local/bin:/out home-k3s-dev:local cp /usr/local/bin/tofu /out/`;
+  then `LIBVIRT_DEFAULT_URI=qemu:///system ~/.local/bin/tofu ...`).
+- **Ansible** talks to the cluster VMs over SSH; simplest to run the pre-installed host `ansible-core`
+  with native networking to the `k3s-dev` NAT subnet.
+- The container remains the baseline for **flux/sops/age/kubectl/helm** (used from inside with
+  `--network host` once the cluster exists).
+
 ## Notes
 - Versions are **best-effort pins**; if a download 404s at build, bump the value in `versions.env`
   (one line) to the current stable and rebuild. The image records the resolved set at