feat: full re-audit of all 7 hosts with fresh ground truth

Deployed check.sh to all 7 hosts at 21:50 CDT. Captures the live state
after the user's PDM migrations:

Cnode movements since last audit:
- cnode1: tsys1 -> tsys9
- cnode2: tsys6 -> tsys7
- cnode5: tsys6 -> tsys7, storage D5(tsys4) -> S2(tsys5)

Wnode changes:
- wnode-tsys1 (102): new VM on S2, stopped
- wnode-tsys3: RAM bumped 20 -> 28 GB
- wnode-tsys6: now running (was stopped)
- wnode-tsys9: storage moved S3 -> S2

Storage distribution improved from 90/10 to 73/27 (tsys4/tsys5).
Still need 2 more cnode moves for etcd quorum survival.

Updated executive summary, k8s distribution tables, storage
utilization, and open items with the fresh data. Captured future k8s
requirements: vcluster + Rancher, OIDC to Keycloak, workload isolation
(RackRental/Suborbital ITAR/non-ITAR/SLP), and solar-aware scale-out
with PowerEdge 19xx/2950 systems.

Added tsys9 to deploy-check.sh host list.

netinfra/gather-configs.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# gather-configs.sh — READ-ONLY. Pull Technitium configs, pihole.toml, gravity.db
+# contents, and chrony NTP details from pfv-netboot for replication.
+set -u
+hdr() { printf '\n=== %s ===\n' "$1"; }
+
+hdr "TECHNITIUM dns.config"
+sudo cat /var/lib/docker/volumes/dns_tsys-dns-config/_data/dns.config 2>&1
+
+hdr "TECHNITIUM auth.config"
+sudo cat /var/lib/docker/volumes/dns_tsys-dns-config/_data/auth.config 2>&1
+
+hdr "TECHNITIUM log.config"
+sudo cat /var/lib/docker/volumes/dns_tsys-dns-config/_data/log.config 2>&1
+
+hdr "TECHNITIUM scopes/Default.scope"
+sudo cat /var/lib/docker/volumes/dns_tsys-dns-config/_data/scopes/Default.scope 2>&1
+
+hdr "TECHNITIUM zone: knel.net.zone"
+sudo cat /var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/knel.net.zone 2>&1
+
+hdr "TECHNITIUM all zone files listing + sizes"
+sudo ls -la /var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/ 2>&1
+
+hdr "TECHNITIUM reverse zones (one sample)"
+sudo cat /var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/199.86.100.in-addr.arpa.zone 2>&1
+
+hdr "TECHNITIUM top-level listing"
+sudo ls -la /var/lib/docker/volumes/dns_tsys-dns-config/_data/ 2>&1
+
+hdr "PI-HOLE pihole.toml (v6 config) from host bind mount"
+cat /root/pihole/etc-pihole/pihole.toml 2>&1
+
+hdr "PI-HOLE dnsmasq.conf"
+cat /root/pihole/etc-pihole/dnsmasq.conf 2>&1
+
+hdr "PI-HOLE versions file"
+cat /root/pihole/etc-pihole/versions 2>&1
+
+hdr "GRAVITY.DB contents (host sqlite3 if present)"
+if command -v sqlite3 >/dev/null 2>&1; then
+    G=/root/pihole/etc-pihole/gravity.db
+    echo "-- adlist --"; sqlite3 -readonly "$G" "SELECT address,enabled,comment,DATE(date_added,'unixepoch'),DATE(date_updated,'unixepoch') FROM adlist;" 2>&1
+    echo "-- adlist count --"; sqlite3 -readonly "$G" "SELECT COUNT(*) FROM adlist;" 2>&1
+    echo "-- domainlist count by type --"; sqlite3 -readonly "$G" "SELECT type,COUNT(*) FROM domainlist GROUP BY type;" 2>&1
+    echo "-- domainlist (allow=0/allow_exact, deny=1/deny_exact, etc.) first 80 --"; sqlite3 -readonly "$G" "SELECT type,domain,enabled,comment FROM domainlist LIMIT 80;" 2>&1
+    echo -- client --"; sqlite3 -readonly "$G" "SELECT ip,comment FROM client;" 2>&1
+    echo "-- group --"; sqlite3 -readonly "$G" "SELECT id,name,enabled,comment FROM 'group';" 2>&1
+    echo "-- info --"; sqlite3 -readonly "$G" "SELECT * FROM info;" 2>&1
+else
+    echo "(sqlite3 not on host PATH)"
+fi
+
+hdr "DONE"