fix(k8s): time-box remote cmds; k3s kubectl in post-setup; codify VM tuning

- join-workers.sh: timeout wrappers (30s token / 60s pre-clean / 300s install)
- post-setup.sh: bare kubectl/etcdctl do not exist on cnodes; use k3s kubectl
  and etcd-snapshot for health checks (taints silently failed before)
- k8s/proxmox-tuning.sh: codifies 2026-09-01 VM tuning (ssd=1,discard=on,
  queues=2, cpuunits, startup order) — dry-run default, RUN=1 applies

[#367][#368] https://projects.knownelement.com/issues/367

k8s/join-workers.sh

@@ -21,7 +21,7 @@ echo "============================================"
 # -------------------------------------------------------
 echo ""
 echo "--- [1/3] Fetching join token from $BOOTSTRAP_NAME ---"
-JOIN_TOKEN=$(cn "$BOOTSTRAP_IP" 'cat /var/lib/rancher/k3s/server/token')
+JOIN_TOKEN=$(timeout 30 cn "$BOOTSTRAP_IP" 'cat /var/lib/rancher/k3s/server/token')
 if [ -z "$JOIN_TOKEN" ] || [[ "$JOIN_TOKEN" == cat:* ]]; then
   echo "FATAL: could not fetch token. Got: ${JOIN_TOKEN:0:40}"
   exit 1
@@ -40,8 +40,8 @@ for i in "${!ALL_WNODES[@]}"; do
   echo ""
   echo "--- [2/3] Joining worker: $node_name ($node_ip) ---"
 
-  # Wipe any existing k3s first
-  cn "$node_ip" '
+  # Wipe any existing k3s first (time-boxed: an unreachable node must not hang the run)
+  timeout 60 cn "$node_ip" '
     systemctl stop k3s-agent 2>/dev/null || true
     if [ -x /usr/local/bin/k3s-agent-uninstall.sh ]; then
       /usr/local/bin/k3s-agent-uninstall.sh
@@ -53,9 +53,9 @@ for i in "${!ALL_WNODES[@]}"; do
     ip link delete flannel.1 2>/dev/null || true
   ' 2>/dev/null || true
 
-  # Install as agent
+  # Install as agent (300s deploy-class limit; a timed-out install is a failed node)
   # shellcheck disable=SC2087 # heredoc intentionally expands local config
-  ssh "${SSH_OPTS[@]}" "${SSH_USER}@${node_ip}" "sudo -n bash -s" <<REMOTE_AGENT
+  timeout 300 ssh "${SSH_OPTS[@]}" "${SSH_USER}@${node_ip}" "sudo -n bash -s" <<REMOTE_AGENT || { echo "  FATAL: $node_name install failed or timed out"; continue; }
 set -euo pipefail
 export INSTALL_K3S_VERSION="$K3S_VERSION"
 export K3S_URL="$SERVER_URL"