Apply rail-knative's declared Knative CPU requests in the installer (RAIL-BS-WP-0015).

install.sh now renders the checksum-verified upstream assets through kustomize
overlays: CRDs first and verbatim, then serving-core and kourier with the six
CPU requests lowered live on 2026-09-21, the Kourier Service as ClusterIP and
the Envoy image pinned. verify.sh checks the requests read-only, and
tests/test_knative_render.py proves the render offline against upstream and
rail-knative's declaration. Not run against the cluster.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

install/knative/overlays/kourier/kustomization.yaml

@@ -0,0 +1,10 @@
+# Overlay over the checksum-verified upstream kourier.yaml, which render.sh
+# stages next to this file as upstream.yaml. render.sh appends the `images:`
+# pin for the Envoy gateway from ENVOY_IMAGE in release-lock.env.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - upstream.yaml
+patches:
+  - path: cpu-requests.patch.yaml
+  - path: service-clusterip.patch.yaml