fix(k8s): time-box remote cmds; k3s kubectl in post-setup; codify VM tuning

- join-workers.sh: timeout wrappers (30s token / 60s pre-clean / 300s install)
- post-setup.sh: bare kubectl/etcdctl do not exist on cnodes; use k3s kubectl
  and etcd-snapshot for health checks (taints silently failed before)
- k8s/proxmox-tuning.sh: codifies 2026-09-01 VM tuning (ssd=1,discard=on,
  queues=2, cpuunits, startup order) — dry-run default, RUN=1 applies

[#367][#368] https://projects.knownelement.com/issues/367

k8s/post-setup.sh

@@ -21,10 +21,11 @@ echo "============================================"
 echo ""
 echo "--- [1/3] Tainting control-plane nodes (NoSchedule) ---"
 for name in "${ALL_CNODE_NAMES[@]}"; do
-  # Set the control-plane role label explicitly
-  cn "$CNODE1_IP" "kubectl label node $name node-role.kubernetes.io/control-plane= --overwrite" 2>/dev/null || true
+  # Set the control-plane role label explicitly.
+  # k3s kubectl only — bare kubectl is not on the cnodes' root PATH.
+  cn "$CNODE1_IP" "k3s kubectl label node $name node-role.kubernetes.io/control-plane= --overwrite" 2>/dev/null || true
   # Apply the taint (idempotent with --overwrite)
-  cn "$CNODE1_IP" "kubectl taint node $name node-role.kubernetes.io/control-plane=true:NoSchedule --overwrite" 2>/dev/null
+  cn "$CNODE1_IP" "k3s kubectl taint node $name node-role.kubernetes.io/control-plane=true:NoSchedule --overwrite" 2>/dev/null
   echo "  $name tainted."
 done
 
@@ -96,10 +97,10 @@ echo "=== Node IPs (should be 100.x Tailscale) ==="
 kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.addresses[?(@.type=="InternalIP")].address}{"\n"}{end}' 2>&1
 
 echo ""
-echo "=== etcd members (should be 3) ==="
-cn "$CNODE1_IP" 'etcdctl --write-out=table endpoint status' 2>&1 \
-  || cn "$CNODE1_IP" 'k3s etcdctl endpoint status --write-out=table' 2>&1 \
-  || echo "(could not query etcd directly)"
+echo "=== API + etcd liveness ==="
+cn "$CNODE1_IP" 'k3s kubectl get --raw=/readyz' 2>&1 || echo "(API not ready)"
+# k3s ships no etcdctl; snapshots answering proves the etcd store is readable
+cn "$CNODE1_IP" 'k3s etcd-snapshot list 2>/dev/null | head -3' 2>&1
 
 echo ""
 echo "=== System pods ==="