chore: initial import from KNEL/PFVCluster@041d311 [#769]

Split per O&M lane work order. Full history: KNEL/PFVCluster.
https://projects.knownelement.com/issues/769#note-4152

scripts/audit-guest-io.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/bash
+# Audit VM disk cache from inside guests — confirm writeback visible + I/O perf
+set -uo pipefail
+source "$(cd "$(dirname "$0")/../../.." && pwd)/k8s/env.sh"
+
+echo "=== CNODES (via Tailscale) ==="
+for ip in "${ALL_CNODES[@]}"; do
+  echo "--- $ip ---"
+  # shellcheck disable=SC2016 # heredoc-style remote command uses $() on the remote side
+  cn "$ip" '
+    echo "  write_cache: $(cat /sys/block/sda/queue/write_cache 2>/dev/null)"
+    echo "  scheduler: $(cat /sys/block/sda/queue/scheduler 2>/dev/null)"
+    echo "  fsync (5x 1KB):"
+    for i in 1 2 3 4 5; do
+      t0=$(date +%s%N)
+      dd if=/dev/zero of=/tmp/.ft bs=1k count=1 conv=fsync 2>/dev/null
+      t1=$(date +%s%N)
+      echo -n " $(( (t1-t0)/1000000 )) ms"
+    done
+    echo
+    rm -f /tmp/.ft
+  ' 2>&1 || echo "  UNREACHABLE"
+done
+
+echo ""
+echo "=== DNS INFRA VMs ==="
+for host in netinfra01 netinfra02; do
+  echo "--- $host ---"
+  # shellcheck disable=SC2016 # heredoc-style remote command uses $() on the remote side
+  netinfra/dns-cluster-setup/remote-dns.sh "$host-root" '
+    echo "  write_cache: $(cat /sys/block/sda/queue/write_cache 2>/dev/null)"
+    echo "  fsync (3x 1KB):"
+    for i in 1 2 3; do
+      t0=$(date +%s%N)
+      dd if=/dev/zero of=/tmp/.ft bs=1k count=1 conv=fsync 2>/dev/null
+      t1=$(date +%s%N)
+      echo -n " $(( (t1-t0)/1000000 )) ms"
+    done
+    echo
+    rm -f /tmp/.ft
+  ' 2>&1 || echo "  UNREACHABLE"
+done