Record operator approval and implement P1–P4: 4G swapfile, journald vacuum, apt upgrade, and UFW lockdown of k3s API/flannel world-open rules. k3s node Ready post-change; residual risk is still tight RAM.
