chore: session close-out — k8s cluster rebuilt, 8/8 nodes Ready [#367][#368]

Details: https://projects.knownelement.com/issues/367

WORKING.md

@@ -5,20 +5,13 @@ A commit is blocked while any task below remains unchecked.
 
 ## Current Tasks
 
-(session state persisted to Redmine #344 tree + #614/#629, Discourse audit #298
-replies 46-48, and git PFVCluster + KNEL/pfv-bms)
+(session state persisted to Redmine #367/#368, Discourse audit #298 reply 51,
+Discourse k8s wiki #305 reply 8, and git PFVCluster d3c5ae8/1f44a19)
 
-- [x] HA stabilized + SSH key-only hardened; git config pipeline live [#344]
-- [x] APC UPS in HA (sensors live); Tripp Lite = physical (#372/#629) [#439]
-- [x] DNS reload-on-change fix (TDD, live-proven) [#469]
-- [x] Kuma dup cleanup + HTTP service monitor [#344]
-- [x] SNMP temp pack deployed; areas + 14 entities placed [#618]
-- [x] Govee integration created (devices pending model numbers) [#620]
-- [x] VictoriaMetrics live intake flowing (prometheus endpoint + VM scrape) [#621]
-- [x] Midea: discovered/DNS/DHCP reserved; token blocked on Carrier backend (#629) [#614]
-- [x] HomeKit VLAN-segmentation finding + vNIC proposal posted [#619]
-- [x] BTU watts source decision: Emporia CT Friday (APC lacks load vars) [#614]
-- [x] Roadmap ticketed #618-#628; backfill parked per founder [#622]
-- [x] DNS incident recovered (serial, health-gated); both Pi-holes serving fresh [#469]
-- [x] AGENTS.md: never dual-kill redundant pairs + blue/green rule + FTL dnsmasq_lines trap
-- [x] Git SoR: pihole.toml (both nodes, secrets redacted) + drift-check.sh (TDD green) — live==git verified [#420][#469]
+- [x] k3s HA control plane rebuilt: 3/3 cnodes Ready, etcd quorum, taints [#367]
+- [x] Proxmox tuning applied (ssd/discard, queues=2, cpuunits, startup order) [#367]
+- [x] Founder moved cnode disks to TS5-SSD; etcd latency 4-5s → <1s [#367]
+- [x] Workers joined: tsys3/6/7/9 + ultix-streaming (replaces tsys5 slot) [#368]
+- [x] Serial bounce wave completed; test pod schedules on worker only [#368]
+- [x] post-setup.sh kubectl bug + join-workers.sh timeouts fixed; tuning codified [#367][#368]
+- [x] ultix-offstage excluded (unreachable) — join when back on tailnet [#368]