Decision from Discourse t/336 posts 3-5 (2026-09-05): option B now, C layered later, flux approved. Four tenant classes with isolation requirements recorded (RackRental hostile/ContainerLab, SLP/Rogue job-confidential, Suborbital CUI/ITAR, HFNOC ERP). https://projects.knownelement.com/issues/699
Framework enforcement layer adopted; shellcheck clean; real kubeconfigs gitignored (example only in repo). Provenance: PFVCluster/k8s. https://projects.knownelement.com/issues/699#note-4536