KNELPerf v2 wave 1: Ultix scheduler breakout + loop skeleton + reports (#826)

- scheduler/: day/night engine (conf-driven redesign), psi/perfsnap collectors,
  proxmox-ctl, systemd timer templates — ported from ~/projects/ultix per the
  breakout map in scheduler/README.md
- loop/: perf-loop driver (baseline/audit/tweak/rebaseline), cpu-bench (new CPU
  leg), baseline-diff (tolerance compare) — smoke-tested locally
- docs/ARCHITECTURE.md: full program design (loop, resource groups, VM/spindle
  balancing, k8s-vs-Slurm, beszel+RAPL/iDRAC telemetry spine, workload classes,
  solar/HA + two-site power economics)
- docs/report-amt-power-telemetry.md + docs/report-moonlight-desktop.md

Redmine: https://projects.knownelement.com/issues/826#note-2

scheduler/proxmox/proxmox-ctl.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# UKRRS Proxmox control wrapper for harness/human use. HARD RULES baked in:
+#   - vmids listed in PROTECTED are never touched (list THIS VM first).
+#   - graceful shutdown only; no reset, no hard stop, no bare down (house rule).
+# Env:
+#   PVE_LOCAL=1                      run ON the pve host itself (pvesh direct)
+#   or PVE_HOST + PVE_TOKEN          remote, token format: user@realm!tokenid=secret
+#   PVE_NODE                         node name (required for vm ops)
+#   PROTECTED                        required, comma-separated vmids
+# Usage:
+#   proxmox-ctl.sh vms
+#   proxmox-ctl.sh shutdown <vmid>
+#   proxmox-ctl.sh start <vmid>
+#   proxmox-ctl.sh snapshot <vmid> <name>
+# Token setup (on the pve host, see docs/REPORT.md appendix B):
+#   pveum user add ukrrs-infra@pam
+#   pveum user token add ukrrs-infra@pam harness -privsep 0 -expire 0
+#   pveum acl modify /pool/<preprod-pool> -user ukrrs-infra@pam -role PVEVMUser
+set -euo pipefail
+: "${PROTECTED:?set PROTECTED=vmid1,vmid2,... (this VM must be in the list)}"
+
+pvesh_() {
+  if [ "${PVE_LOCAL:-0}" = 1 ]; then
+    command pvesh "$@"
+  else
+    : "${PVE_HOST:?}" "${PVE_TOKEN:?}"
+    command pvesh --host "$PVE_HOST" --api-token "$PVE_TOKEN" "$@"
+  fi
+}
+
+guard() {
+  case ",$PROTECTED," in
+    *",$1,"*) echo "REFUSED: vmid $1 is PROTECTED" >&2; exit 3 ;;
+  esac
+}
+
+cmd=${1:-}; shift || true
+case "$cmd" in
+  vms)
+    pvesh_ get /cluster/resources --type vm ;;
+  shutdown)
+    [ $# = 1 ] || { echo "usage: $0 shutdown <vmid>" >&2; exit 2; }
+    guard "$1"; : "${PVE_NODE:?}"
+    pvesh_ create "/nodes/$PVE_NODE/qemu/$1/status/shutdown" --timeout 120 ;;
+  start)
+    [ $# = 1 ] || { echo "usage: $0 start <vmid>" >&2; exit 2; }
+    guard "$1"; : "${PVE_NODE:?}"
+    pvesh_ create "/nodes/$PVE_NODE/qemu/$1/status/start" ;;
+  snapshot)
+    [ $# = 2 ] || { echo "usage: $0 snapshot <vmid> <name>" >&2; exit 2; }
+    guard "$1"; : "${PVE_NODE:?}"
+    pvesh_ create "/nodes/$PVE_NODE/qemu/$1/snapshot" snapname="$2" ;;
+  *)
+    echo "usage: $0 vms|shutdown <vmid>|start <vmid>|snapshot <vmid> <name>" >&2
+    exit 2 ;;
+esac