feat(installer): size the default training budget to the machine (backend#1236, option A)

[LukasWodka]

Implements tracebloc/backend#1236 (option A — decided 2026-07-24; option B stays in the backlog as tracebloc/backend#1237).

Why

The static cpu=2,memory=8Gi default is wrong at both ends: dead on arrival on nodes under 8 GiB (the WSL2 field case — doctor 'not ready', nothing can schedule until the user discovers resources set) and ~12% utilisation on a 64 GiB box — while the wizard itself calls 'use as much as possible' recommended.

What

Both installers now write env.RESOURCE_REQUESTS/LIMITS (requests == limits, Guaranteed QoS preserved) sized to the machine. Precedence, mirrored bash ⇄ ps1:

1. TRACEBLOC_TRAINING_RESOURCES (explicit override; new on Windows, documented in the ps1 header)
2. the installed release's current value — fixes a latent clobber: today a re-install resets a user's tracebloc resources set choice back to 2/8; now it's carried
3. machine sizing: largest node allocatable − ~1 CPU / 3 GiB overhead (largest, not summed — k3d's server+agent are one machine, resources/home: "equipped with" sums allocatable across k3d nodes — reports 2× the machine (24 CPU · 13.4 GiB on a 12-core host) cli#399), floors 1 CPU / 2 GiB
4. the historic static fallback (tiny or undeterminable machines — behavior unchanged there)

Field machine example: 6.76 GiB node ⇒ cpu=11,memory=3Gi ⇒ doctor green on day one. Chart fallback stays 2/8 for hand-rolled helm installs.

Tests

• bash (bats, 6 new): override-wins-no-probing; existing-choice carried (quoted and helm's unquoted re-serialization — the Windows installer: one-client-per-machine guard misses unquoted/single-quoted clientId #200 lesson); largest-node sizing (two identical k3d nodes ⇒ NOT summed); below-floor fallback; kubectl-absent fallback; the old static integration test now pins the fallback path with kubectl stubbed.
• ps1 (Pester, 5 new): same matrix via Get-TrainingResources.
• bash -n, CI-mode shellcheck, check-style.sh clean; manifest.sha256 regenerated (R8). (One pre-existing bats failure on macOS bash 3.2 — _extract_yaml_value: single-quoted — fails identically on pristine develop; Linux CI is the authority.)

Follow-ups

• doctor drift nudge rides doctor: "raise the machine's allocation in Docker Desktop → Resources" is wrong on Windows/WSL2 (.wslconfig governs memory) cli#400.
• Merge-order: feat(installer): fail fast on disabled firmware virtualization + WSL2-aware memory hints (#387) #392 also touches install-k8s.ps1/manifest — whichever lands second needs a trivial manifest regen.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes default pod resource requests/limits at install/re-install (scheduling and capacity behavior), though precedence preserves explicit user choices and degrades safely when the API is unreachable.

Overview
Replaces the fixed cpu=2,memory=8Gi training default in the Linux (install-client-helm.sh) and Windows (install-k8s.ps1) installers with a shared precedence: TRACEBLOC_TRAINING_RESOURCES (now documented on Windows), then a non-default value already on the Helm release (so tracebloc resources set survives re-install), then machine sizing from the largest node’s allocatable CPU/memory minus ~1 CPU / ~3 GiB (k3d nodes are not summed), else the historic cpu=2,memory=8Gi fallback.

Generated values.yaml writes matching RESOURCE_LIMITS and RESOURCE_REQUESTS. Cluster probes use boundedkubectl/helm calls so a wedged API falls back instead of hanging install. manifest.sha256 is updated; bats and Pester add coverage for override, carry-forward, static-default non-carry, sizing, and fallbacks.

^{Reviewed by Cursor Bugbot for commit bdbd08c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[LukasWodka]

bugbot run

[LukasWodka]

bugbot run

[LukasWodka]

bugbot run

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f69d9df. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit bdbd08c. Configure here.}

[LukasWodka]

Functional review \u2014 passed\n\nBasis: the behavioural suites that ran on this PR at merge against real environments, not mocks:\n\n- on multiple Ubuntu releases + \u2014 a real install exercised end-to-end on real distros, behind a TLS-inspecting proxy\n\nI could not reach the dev API (no dev credentials), so rather than rubber-stamp I used the strongest evidence available: these suites exercise the actual behaviour this change alters, on real infrastructure. Advancing \u2192 .\n\nIf the functional reviewer wants a manual pass on dev in addition, please move it back and say so.