Autonomous session: Phase-2 platform authoring + Flux bootstrap progress

Author-only Phase-2 components (platform suspended; cluster untouched):
- platform/longhorn: 3-replica SC + bulk external-mount indirection (R-STATE)
- platform/monitoring: kube-prometheus-stack + Loki + Alloy (dev-trimmed) + 8 alert rules (R-OBS)
- platform/cilium: parity fix (k8sServiceHost=10.73.0.11 + masquerade) safe to adopt Phase 2
- conformance: partial L2 tests (worker hit session limit; incomplete — see DECISIONS-LOG K2)
- bootstrap/gitea: fix rootless-podman perms (host bind-mount -> named volume)

Flux installed on the cluster; host Gitea up + repo pushed; GitRepository BLOCKED by
host firewalld (VM->10.73.0.1:3000) — needs one operator sudo command (DECISIONS-LOG).
Known issue K1: cluster-vars substitution-var case mismatch (fix before un-suspend).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

bootstrap/gitea/bootstrap-gitea.sh

@@ -12,21 +12,26 @@ GITEA_IMAGE="${GITEA_IMAGE:-docker.io/gitea/gitea:1.22}"   # pinned; bump if nee
 NAME="${GITEA_NAME:-home-k3s-bootstrap-gitea}"
 HTTP_PORT="${GITEA_HTTP_PORT:-3000}"
 SSH_PORT="${GITEA_SSH_PORT:-2222}"
-DATA_DIR="${GITEA_DATA_DIR:-${HOME}/.local/share/home-k3s-bootstrap-gitea}"
+# Use a NAMED podman volume, not a host bind-mount: rootless podman maps the container's uid to a
+# subuid that can't write a host-owned dir, so Gitea fails to create /data/gitea/conf/app.ini.
+DATA_VOLUME="${GITEA_DATA_VOLUME:-gitea-bootstrap-data}"
+DATA_DIR="podman volume ${DATA_VOLUME}"   # display label only (data lives in the named volume)
 # The cluster VMs reach the host on the k3s-dev NAT gateway (10.73.0.1). ROOT_URL must match so
 # clone/redirect URLs are correct from inside the cluster.
+# NOTE: firewalld's `libvirt` zone (owns virbrN) blocks VM->host:3000 by default. Open it once:
+#   sudo firewall-cmd --zone=libvirt --add-port=3000/tcp --permanent && sudo firewall-cmd --reload
 HOST_NAT_IP="${HOST_NAT_IP:-10.73.0.1}"
 ORG="${GITEA_ORG:-Home-Network}"
 REPO="${GITEA_REPO:-home-network-k3s-impl}"
 
-mkdir -p "${DATA_DIR}"
+"$ENGINE" volume create "${DATA_VOLUME}" >/dev/null 2>&1 || true
 if "$ENGINE" container exists "$NAME" 2>/dev/null; then
   echo "Gitea container '${NAME}' already exists — starting it."
   "$ENGINE" start "$NAME" >/dev/null
 else
   "$ENGINE" run -d --name "$NAME" --restart unless-stopped \
     -p "${HTTP_PORT}:3000" -p "${SSH_PORT}:22" \
-    -v "${DATA_DIR}:/data" \
+    -v "${DATA_VOLUME}:/data" \
     -e GITEA__server__ROOT_URL="http://${HOST_NAT_IP}:${HTTP_PORT}/" \
     -e GITEA__server__SSH_PORT="${SSH_PORT}" \
     -e GITEA__security__INSTALL_LOCK=true \