feat: Phase 1 FDA host-operator Role and railiance01 pilot (WP-0009 T02–T07)

Lock DEC-FDA-001 working defaults; add roles/host-operator package with
OS/security and load protocols; scaffold eng-coulomb-railiance01-ho-001
with bound agent, vault, ramp checklists, and Kai quote/ledger.

roles/host-operator/protocols/load-workload-review.md

@@ -0,0 +1,103 @@
+---
+agent: host-operator
+slug: load-workload-review
+title: Load and Workload Review
+version: 0.1.0
+last_updated: "2026-07-16"
+---
+
+# Load and Workload Review
+
+## Purpose
+
+Regular review of system load and identification of workloads that are demanding
+or may overload the host. Establishes and updates the **load envelope** in memory.
+
+## Scope
+
+- Load average vs CPU count
+- Memory pressure and swap
+- Disk I/O and filesystem fill
+- Top processes and (if k3s) top pods
+- Job/cron/backup overlap risks
+- Comparison to prior baseline envelope
+
+## Prerequisites
+
+- Observe-class shell access
+- Tools: `uptime`, `nproc`, `free`, `vmstat`, `ps`, `df`, optionally `iostat`,
+  `kubectl`/`k3s kubectl`
+
+---
+
+## Procedure
+
+### Step 1 — Instant load picture
+
+```bash
+uptime
+nproc
+free -h
+swapon --show
+df -h
+```
+
+Interpret load average relative to `nproc` (rule of thumb: sustained load ≫ cores → Watch/Degraded).
+
+### Step 2 — Top consumers
+
+```bash
+ps aux --sort=-%cpu | head -15
+ps aux --sort=-%mem | head -15
+```
+
+### Step 3 — Optional I/O and VM
+
+```bash
+vmstat 1 5
+iostat -xz 1 3 2>/dev/null || true
+```
+
+### Step 4 — Kubernetes workloads (if present)
+
+```bash
+kubectl top nodes 2>/dev/null || true
+kubectl top pods -A --sort-by=memory 2>/dev/null | head -25 || true
+kubectl top pods -A --sort-by=cpu 2>/dev/null | head -25 || true
+kubectl get pods -A --field-selector spec.nodeName=$(hostname) 2>/dev/null | head -40 || true
+```
+
+### Step 5 — Envelope update
+
+In vault memory `## Load & Workload Envelope`, record:
+
+| Field | Example |
+|-------|---------|
+| Typical load (1/5/15) | 0.4 / 0.5 / 0.6 on 4 cores |
+| Peak seen | … |
+| Heavy workloads | forgejo runner, backups, … |
+| Saturation incidents | date · symptom · resolution |
+| Headroom notes | disk 40% free; mem OK |
+
+### Step 6 — Demand flags
+
+Flag as findings when:
+
+- Sustained load > cores without known batch job
+- Memory available critically low or swap thrash
+- Disk > 85% on critical mounts
+- Single pod/process dominating resources without request/limit awareness
+- Concurrent heavy jobs (backup + build + migrate)
+
+## Output template
+
+```markdown
+# Load & Workload Review — <hostname> — <date>
+
+## Summary
+## Load vs capacity
+## Top consumers
+## Envelope delta (vs last review)
+## Overload / demand risks
+## Recommended next steps (safe first)
+```