feat(perf): census covers cpu + disk, report-only [#757]

CPU via the same docker stats pass joined to app fqdns; disk = root fs
pct + docker system df + top-15 appdata dirs joined to fqdns. CPU/disk
are REPORT-ONLY per t/317 (human-required class).

Details: https://projects.knownelement.com/issues/757#note-1

perf/memcensus-util.sh

@@ -1,19 +1,21 @@
 #!/usr/bin/env bash
-# perf/memcensus-util.sh — live per-app memory utilization census (all apps,
+# perf/memcensus-util.sh — live per-app resource census: memory utilization
-# %-sorted) + 24h memcg-OOM evidence. Read-only. [#685/#731]
+# (%-sorted), per-container CPU, host disk + docker space, and 24h
+# memcg-OOM evidence. Read-only. [#685/#731/#757]
 #
 # Run (from a checkout):
-#   VM_IP=my.knownelement.com VM_USER=root timeout 120 bash tests/remote.sh vm-file perf/memcensus-util.sh
+#   VM_IP=my.knownelement.com VM_USER=root timeout 300 bash tests/remote.sh vm-file perf/memcensus-util.sh
 # Needs: docker + awk on the host. Pairs with the daily monitor automation
-# (founder directive 2026-09-02: monitor/adjust over time — bump >80% utilized
+# (ratified policy t/317: memory >80%/OOM auto-bump under standing
-# apps, never decrease, never touch bi/platform services).
+# authorization; CPU + disk are REPORT-ONLY — human-required class,
+# founder directive 2026-09-03, #757).
 
 set -u
 
 TMP=$(mktemp -d) || exit 1
 trap 'rm -rf "$TMP"' EXIT
 
-docker stats --no-stream --format "{{.Name}} {{.MemUsage}}" > "$TMP/usage"
+docker stats --no-stream --format "{{.Name}} {{.CPUPerc}} {{.MemUsage}}" > "$TMP/stats"
 docker ps --format "{{.Names}}" | while read -r n; do
     lim=$(docker inspect "$n" --format '{{.HostConfig.Memory}}' 2>/dev/null)
     fq=$(docker inspect "$n" --format '{{range .Config.Env}}{{println .}}{{end}}' 2>/dev/null \
@@ -22,9 +24,10 @@ docker ps --format "{{.Names}}" | while read -r n; do
     [ -n "$fq" ] && printf '%s|%s|%s\n' "$n" "$fq" "$lim"
 done > "$TMP/limits"
 
+echo "== memory utilization (apps with >=200MB limit, %-sorted) =="
 awk 'NR==FNR {
-    gsub(/,/,"");
+    gsub(/,/,"", $3);
-    if ($2 ~ /G/) u[$1] = $2 * 1024; else u[$1] = $2 + 0;
+    if ($3 ~ /G/) u[$1] = $3 * 1024; else u[$1] = $3 + 0;
     next
   }
   {
@@ -32,7 +35,28 @@ awk 'NR==FNR {
     lim = f[3] / 1048576; use = u[f[1]] + 0
     if (lim >= 200 && use > 0)
       printf "%5.1f%% | %7.0fMB used | %6.0fMB limit | %s\n", use/lim*100, use, lim, f[2]
-  }' "$TMP/usage" "$TMP/limits" | sort -rn | head -30
+  }' "$TMP/stats" "$TMP/limits" | sort -rn | head -30
+
+echo "== cpu per container (top 12, incl. platform; report-only) =="
+awk 'NR==FNR { n = split($0, f, "|"); fq[f[1]] = f[2]; next }
+  { sub(/%/, "", $2)
+    name = ($1 in fq) ? fq[$1] : $1
+    printf "%8.2f%% | %s\n", $2, name }' "$TMP/limits" "$TMP/stats" \
+    | sort -rn | head -12
+
+echo "== disk (report-only; >=80% used = human-required flag per t/317) =="
+df -h / | awk 'NR==2 {
+    printf "root fs: %s used of %s (%s used)\n", $3, $2, $5
+    if ($5 + 0 >= 80) print "WARN: root fs >=80% used — human-required, propose only"
+  }'
+docker system df
+echo "-- top app-data dirs (MB; du capped at 60s — partial ranking if capped) --"
+timeout 60 du -sm /home/yellowtent/appsdata/* 2>/dev/null \
+    | awk '{ sub(/.*appsdata\//, "", $2); print }' > "$TMP/du"
+awk 'NR==FNR { n = split($0, f, "|"); fq[f[1]] = f[2]; next }
+  { name = ($2 in fq) ? fq[$2] : $2
+    printf "%8dMB | %s\n", $1, name }' "$TMP/limits" "$TMP/du" \
+    | sort -rn | head -15
 
 echo "== memcg OOM events, last 24h =="
 journalctl --since "-24 hours" --no-pager 2>/dev/null \