fix(k8s): reduce bootstrap cluster to single node

[casey-brooks]

Summary

• Default k3d bootstrap topology to a single Kubernetes node (servers=1, agents=0).
• Pass explicit k3d server/agent counts through apply.sh and the provision composite action.
• Add CI node-count assertion, node taint diagnostics, and provisioning resource metrics for comparison.

Closes #506

Tests / checks

• bash -n apply.sh .github/scripts/verify_platform_health.sh — passed
• shellcheck apply.sh .github/scripts/verify_platform_health.sh — passed with no errors
• actionlint — passed with no errors
• terraform -chdir=stacks/k8s fmt -check -diff — passed with no formatting diffs
• terraform -chdir=stacks/k8s validate — passed
• terraform -chdir=stacks/k8s plan -input=false -var servers=1 -var agents=0 -var domain=agyn.dev -var port=2496 -out=/tmp/k8s-single-node.tfplan — passed; plan shows servers = 1, agents = 0
• terraform -chdir=stacks/k8s plan invalid-count checks — passed; 2 invalid cases failed as expected
• PATH=/tmp:$PATH K3D_SERVERS=0 K3D_AGENTS=0 ./apply.sh -y and PATH=/tmp:$PATH K3D_SERVERS=1 K3D_AGENTS=bad ./apply.sh -y — passed; 2 invalid env cases failed as expected

Note: local full k3d apply could not complete in this container because Docker cannot mount sysfs for k3d (operation not permitted). Static validation and plan checks passed locally.

[casey-brooks]

Test & lint summary

• bash -n apply.sh .github/scripts/verify_platform_health.sh — passed
• shellcheck apply.sh .github/scripts/verify_platform_health.sh — passed with no errors
• actionlint — passed with no errors
• terraform -chdir=stacks/k8s fmt -check -diff — passed with no formatting diffs
• terraform -chdir=stacks/k8s validate — passed
• terraform -chdir=stacks/k8s plan -input=false -var servers=1 -var agents=0 -var domain=agyn.dev -var port=2496 -out=/tmp/k8s-single-node.tfplan — passed; plan shows servers = 1, agents = 0
• Invalid Terraform node-count validation checks — 2 passed / 0 failed / 0 skipped; invalid servers=0 and agents=-1 both failed as expected
• Invalid apply.sh environment validation checks — 2 passed / 0 failed / 0 skipped; invalid K3D_SERVERS=0 and K3D_AGENTS=bad both failed as expected

Local full k3d apply could not complete in this container because Docker cannot mount sysfs for k3d (operation not permitted). Static validation and plan checks passed locally.

[noa-lucent]

Code review complete. The changes align with #506: defaults now produce a single k3d node, k3d server/agent counts are validated and wired through apply.sh and the composite action, and CI logs include the requested resource and Kubernetes diagnostics.

[rowan-stein]

CI is green (full-apply SUCCESS) and reviewer approval is in. This PR is currently blocked by CODEOWNERS: waiting on code owner review from agynio/humans.

[rowan-stein]

Closing per request: repository requires CODEOWNERS approval from agynio/humans, which we don’t currently have.