Declare the Knative v1.22.0 substrate CPU requests set live on railiance01

Strategic-merge patches and a kustomization over the checksum-pinned
upstream assets, a runbook with the rollout-deadlock and HPA lessons,
offline tests, and RAIL-KNATIVE-WP-0002 with the railiance-cluster
installer handoff as a wait task. Verified read-only against live.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

substrate/v1.22.0/cpu-requests.patch.yaml

@@ -0,0 +1,100 @@
+# Declared CPU requests for the Knative Serving + Kourier v1.22.0 substrate.
+# Strategic-merge patches over the upstream release manifests (serving-core.yaml,
+# kourier.yaml), checksum-pinned in railiance-cluster/install/knative/release-lock.env.
+# Only CPU requests are set; memory requests and all limits stay upstream.
+# Live on railiance01 since 2026-09-21 (ADMINISTER @ realm:kubernetes/railiance01,
+# activation=APPROVED by the founder). Re-applying upstream without these patches
+# restores the upstream values noted per document and re-exhausts the node.
+# Apply after each upstream apply, e.g. for each document:
+#   kubectl patch deployment <name> -n <ns> --type strategic --patch-file <doc>
+# or list this file under `patches:` in a kustomization over the staged assets.
+---
+# upstream v1.22.0 request: 300m
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: activator
+  namespace: knative-serving
+spec:
+  template:
+    spec:
+      containers:
+        - name: activator
+          resources:
+            requests:
+              cpu: 50m
+---
+# upstream v1.22.0 request: 100m
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: autoscaler
+  namespace: knative-serving
+spec:
+  template:
+    spec:
+      containers:
+        - name: autoscaler
+          resources:
+            requests:
+              cpu: 30m
+---
+# upstream v1.22.0 request: 100m
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: controller
+  namespace: knative-serving
+spec:
+  template:
+    spec:
+      containers:
+        - name: controller
+          resources:
+            requests:
+              cpu: 30m
+---
+# upstream v1.22.0 request: 100m
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: webhook
+  namespace: knative-serving
+spec:
+  template:
+    spec:
+      containers:
+        - name: webhook
+          resources:
+            requests:
+              cpu: 30m
+---
+# upstream v1.22.0 request: 200m
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: net-kourier-controller
+  namespace: knative-serving
+spec:
+  template:
+    spec:
+      containers:
+        - name: controller
+          resources:
+            requests:
+              cpu: 30m
+---
+# upstream v1.22.0 request: 200m
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: 3scale-kourier-gateway
+  namespace: kourier-system
+spec:
+  template:
+    spec:
+      containers:
+        - name: kourier-gateway
+          resources:
+            requests:
+              cpu: 50m

substrate/v1.22.0/kustomization.yaml

@@ -0,0 +1,12 @@
+# Overlay for the checksum-verified upstream assets staged by
+# railiance-cluster/install/knative/install.sh (core.yaml, kourier.yaml).
+# crds.yaml stays a separate first apply: core.yaml repeats one CRD, so kustomize
+# refuses both in one build. Copy the staged files next to this kustomization,
+# then `kubectl kustomize .`.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - core.yaml
+  - kourier.yaml
+patches:
+  - path: cpu-requests.patch.yaml