feat(awx): deploy AWX 24.6.1 on tsys-awx via k3s + AWX Operator

AWX (Ansible automation controller) deployed on tsys-awx.knel.net (VMID 600
on pfv-tsys6). Accessible at http://tsys-awx.knel.net:80 (admin/REDACTED_PASSWORD).

Deployment details:
- k3s v1.36.2 single-node (no Traefik) on Debian 13 trixie
- AWX Operator 2.19.1 + AWX CR (LoadBalancer service via k3s ServiceLB)
- PostgreSQL 15 bundled (8 GiB PVC on local-path provisioner)
- VM disk resized 32->60 GB; swap partition converted to swapfile
- Fixed kube-rbac-proxy image (gcr.io removed -> quay.io/brancz replacement)
- Fixed AWX CR field names (postgres_data_volume_size ->
  postgres_storage_requirements)

Scripts: awx/install-k3s.sh, awx/deploy-awx.sh, awx/verify-awx.sh
Manifests: awx/awx-instance.yaml, awx/namespace.yaml
Docs: awx/README.md

All pods running: operator 2/2, postgres 1/1, web 3/3, task 4/4.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

awx/README.md

@@ -0,0 +1,96 @@
+# AWX — tsys-awx.knel.net
+
+Ansible AWX deployment on a dedicated k3s single-node VM.
+
+**[→ Deployment Plan](DEPLOYMENT.md)** · **[→ Status](../../STATUS.md)**
+
+## Access
+
+| | |
+|---|---|
+| URL | `http://tsys-awx.knel.net` (LAN) or `http://100.91.39.53` (Tailscale) |
+| Port | 80 (LoadBalancer via k3s ServiceLB) |
+| User | `admin` |
+| Password | `REDACTED_PASSWORD` (fleet standard) |
+
+## Architecture
+
+```
+tsys-awx (VMID 600 on pfv-tsys6)
+├── k3s v1.36.2+k3s1 (single-node, no Traefik)
+├── AWX Operator 2.19.1 (manages the AWX lifecycle)
+└── AWX instance "tsys-awx"
+    ├── AWX web (UI/API)
+    ├── AWX task (Celery workers)
+    ├── PostgreSQL 15 (bundled, 8 GiB PVC on local-path)
+    ├── Redis (ephemeral)
+    └── ServiceLB (binds port 80 to host IP)
+```
+
+## VM Resources
+
+| Resource | Value |
+|----------|-------|
+| Host | pfv-tsys6 (2× Xeon E5530, 126 GB RAM) |
+| vCPU | 4 (2 sockets × 2 cores) |
+| RAM | 12 GB |
+| Disk | 60 GB (D5 on tsys4 NFS) |
+| OS | Debian 13 trixie |
+| Network | 192.168.3.200 (LAN), 100.91.39.53 (Tailscale) |
+
+## Files
+
+| File | Purpose |
+|------|---------|
+| [`install-k3s.sh`](install-k3s.sh) | Install k3s single-node (no Traefik) |
+| [`deploy-awx.sh`](deploy-awx.sh) | Deploy AWX Operator 2.19.1 + AWX instance |
+| [`verify-awx.sh`](verify-awx.sh) | Verify deployment status + access |
+| [`namespace.yaml`](namespace.yaml) | Kubernetes namespace manifest |
+| [`awx-instance.yaml`](awx-instance.yaml) | AWX Custom Resource (CR) manifest |
+
+## Deployment (from scratch)
+
+```bash
+# 1. Push scripts to VM
+for f in awx/install-k3s.sh awx/deploy-awx.sh awx/verify-awx.sh \
+         awx/namespace.yaml awx/awx-instance.yaml; do
+    VM_IP=100.91.39.53 VM_USER=localuser bash tests/remote.sh vm \
+        "sudo tee /tmp/awx/$(basename $f) > /dev/null" < "$f"
+done
+
+# 2. Install k3s
+VM_IP=100.91.39.53 VM_USER=localuser bash tests/remote.sh vm \
+    "sudo bash /tmp/awx/install-k3s.sh"
+
+# 3. Deploy AWX
+VM_IP=100.91.39.53 VM_USER=localuser bash tests/remote.sh vm \
+    "sudo bash /tmp/awx/deploy-awx.sh"
+
+# 4. Verify
+VM_IP=100.91.39.53 VM_USER=localuser bash tests/remote.sh vm \
+    "bash /tmp/awx/verify-awx.sh"
+```
+
+## Operating
+
+```bash
+# kubectl access
+sudo k3s kubectl -n awx get pods
+sudo k3s kubectl -n awx logs -f deployment/awx-operator-controller-manager
+
+# Restart AWX instance
+sudo k3s kubectl -n awx delete awx tsys-awx  # operator will recreate
+
+# Get admin password
+sudo k3s kubectl -n awx get secret awx-admin-password -o jsonpath='{.data.password}' | base64 -d
+```
+
+## Known Issues
+
+1. **kube-rbac-proxy image**: The AWX Operator 2.19.1 references
+   `gcr.io/kubebuilder/kube-rbac-proxy:v0.15.0` which was removed from GCR.
+   The deploy script patches this to `quay.io/brancz/kube-rbac-proxy:v0.15.0`.
+2. **Image pulls are slow**: First deployment pulls ~2 GB of container images.
+   Postgres image alone is ~400 MB and takes several minutes.
+3. **Disk space**: AWX + k3s uses ~10 GB of the 60 GB disk. PostgreSQL data
+   grows over time — monitor `df -h /`.