ops: apply approved host-operator remediations on railiance01

Record operator approval and implement P1–P4: 4G swapfile, journald vacuum,
apt upgrade, and UFW lockdown of k3s API/flannel world-open rules. k3s node
Ready post-change; residual risk is still tight RAM.

engagements/pilots/eng-coulomb-railiance01-ho-001/vault/session-log/2026-07-16-privileged-approval.md

@@ -0,0 +1,32 @@
+# Human approval — privileged remediation batch
+
+**Engagement:** eng-coulomb-railiance01-ho-001
+**Date:** 2026-07-16
+**Approver:** Bernd (operator) — via session instruction: *“approve the suggested tasks… implement them”*
+**Agent:** host-operator (grok session)
+
+## Approved items
+
+| ID | Action | Class |
+|----|--------|--------|
+| P1 | Emergency swap file (~4G) on root FS | privileged_ops |
+| P2 | journald vacuum to ~500M | privileged_ops |
+| P3 | OS package upgrades (apt) + needrestart awareness | package_upgrade |
+| P4 | Tighten UFW: remove world-open 6443/8472; allow k3s API from known operator IPs | firewall_change |
+
+## Explicit non-goals
+
+- Hardware RAM upgrade (provider console — not shell-implementable here)
+- Unilateral workload kill / pod deletion
+- Reboot unless needrestart shows kernel requires it **and** operator re-confirms mid-session
+
+## Rollback notes
+
+- P1: `swapoff` + remove swapfile + fstab line
+- P2: logs not recoverable
+- P3: package-specific rollback / restore
+- P4: re-add `ufw allow 6443/tcp` and `8472/udp` if access breaks
+
+## Status
+
+Approved for immediate implementation under host_observe + gated classes above.