Autonomous session: Phase-2 platform authoring + Flux bootstrap progress

Author-only Phase-2 components (platform suspended; cluster untouched):
- platform/longhorn: 3-replica SC + bulk external-mount indirection (R-STATE)
- platform/monitoring: kube-prometheus-stack + Loki + Alloy (dev-trimmed) + 8 alert rules (R-OBS)
- platform/cilium: parity fix (k8sServiceHost=10.73.0.11 + masquerade) safe to adopt Phase 2
- conformance: partial L2 tests (worker hit session limit; incomplete — see DECISIONS-LOG K2)
- bootstrap/gitea: fix rootless-podman perms (host bind-mount -> named volume)

Flux installed on the cluster; host Gitea up + repo pushed; GitRepository BLOCKED by
host firewalld (VM->10.73.0.1:3000) — needs one operator sudo command (DECISIONS-LOG).
Known issue K1: cluster-vars substitution-var case mismatch (fix before un-suspend).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

conformance/run.sh

@@ -9,6 +9,7 @@
 #   ./run.sh                          # full suite; skips L1/L2/L3 if no cluster
 #   ./run.sh --requirements R-NET-01,R-NET-06   # merge-gate subset (tagged)
 #   ./run.sh --layer l2               # one layer
+#   ./run.sh --requirements R-NET-01,R-NET-02 --layer l2   # intersect: tagged AND in layer
 #   ./run.sh --coverage-only          # regenerate coverage report only (no cluster)
 #   ./run.sh --lint                   # structural-validate test defs (no cluster)
 #   ./run.sh --strict-coverage        # hygiene gate: fail on tag/annotation drift
@@ -108,7 +109,15 @@ lint_tests() {
 
 # --- Select which test directories Chainsaw should run --------------------------------
 select_dirs() {
-  if [ -n "${REQS}" ]; then
+  # --requirements AND --layer together => intersection (tests carrying the tag
+  # AND living in that layer subtree). Either alone keeps its prior meaning, so
+  # this is backward compatible (LAYER defaults to "all"). Both helpers emit
+  # sorted, de-duplicated dirs, so `comm -12` yields the intersection.
+  if [ -n "${REQS}" ] && [ "${LAYER}" != all ]; then
+    comm -12 \
+      <(conf_dirs_for_requirements "${REQS}") \
+      <(conf_dirs_for_layer "${LAYER}")
+  elif [ -n "${REQS}" ]; then
     conf_dirs_for_requirements "${REQS}"
   else
     conf_dirs_for_layer "${LAYER}"