Fleet monitoring: sysstat 28d + perfsnap/PSI/iotop timers + on-demand toolbox container (#826)

- monitoring/node-install.sh: idempotent per-node installer (sar HISTORY=28,
  three oneshot timers, per-node conf with qemu.slice/lxc cgroup globs)
- monitoring/collectors + systemd units: iotop-snap 15min, perfsnap 60s,
  psi-textfile 15s (now sources /etc/knelperf/perfsnap.conf; multi-glob)
- monitoring/toolbox: pct LXC (vmid 950, privileged, apparmor unconfined,
  stopped at rest) + knelperf-toolbox wrapper + Dockerfile variant
- monitoring/deploy-fleet.sh: workstation-side rollout driver
- piloted on pfv-tsys1: per-VM PSI gauges verified live

Redmine: https://projects.knownelement.com/issues/826

monitoring/toolbox/knelperf-toolbox

@@ -0,0 +1,27 @@
+#!/bin/sh
+# knelerf-toolbox — front door to the on-demand perf toolbox LXC on this node.
+# usage: knelperf-toolbox run '<cmd>'   (starts the LXC if stopped, runs, leaves it up)
+#        knelperf-toolbox shell         (interactive)
+#        knelperf-toolbox start|stop|status
+# The LXC (vmid 950) is STOPPED at rest — zero footprint; stop it when done.
+# Docs: https://community.turnsys.com/t/328
+VMID=${KNELPERF_TOOLBOX_VMID:-950}
+
+ensure_running() {
+  pct status "$VMID" 2>/dev/null | grep -q running && return 0
+  pct start "$VMID"
+  i=0
+  until pct exec "$VMID" -- true 2>/dev/null; do
+    i=$((i + 1)); [ $i -gt 45 ] && { echo "boot timeout" >&2; return 1; }
+    sleep 2
+  done
+}
+
+case "${1:-help}" in
+  run)    shift; ensure_running && pct exec "$VMID" -- sh -c "$*" ;;
+  shell)  ensure_running && pct enter "$VMID" ;;
+  start)  ensure_running ;;
+  stop)   pct shutdown "$VMID" --timeout 60 2>/dev/null || pct stop "$VMID" ;;
+  status) pct status "$VMID" 2>/dev/null || echo "vmid $VMID not present" ;;
+  *)      sed -n '2,6p' "$0" | sed 's/^# \?//' ;;
+esac