Apply rail-knative's declared Knative CPU requests in the installer (RAIL-BS-WP-0015).

install.sh now renders the checksum-verified upstream assets through kustomize
overlays: CRDs first and verbatim, then serving-core and kourier with the six
CPU requests lowered live on 2026-09-21, the Kourier Service as ClusterIP and
the Envoy image pinned. verify.sh checks the requests read-only, and
tests/test_knative_render.py proves the render offline against upstream and
rail-knative's declaration. Not run against the cluster.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

install/knative/overlays/serving-core/cpu-requests.patch.yaml

@@ -0,0 +1,66 @@
+# CPU requests declared by rail-knative (substrate/v1.22.0/cpu-requests.patch.yaml),
+# the documents of that file that target serving-core.yaml. Only CPU requests are set;
+# memory requests and all limits stay upstream. Live on railiance01 since
+# 2026-09-21 (ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED by
+# the founder). Keep in step with rail-knative: tests/test_knative_render.py
+# fails if the two declarations disagree.
+---
+# upstream v1.22.0 request: 300m
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: activator
+  namespace: knative-serving
+spec:
+  template:
+    spec:
+      containers:
+        - name: activator
+          resources:
+            requests:
+              cpu: 50m
+---
+# upstream v1.22.0 request: 100m
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: autoscaler
+  namespace: knative-serving
+spec:
+  template:
+    spec:
+      containers:
+        - name: autoscaler
+          resources:
+            requests:
+              cpu: 30m
+---
+# upstream v1.22.0 request: 100m
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: controller
+  namespace: knative-serving
+spec:
+  template:
+    spec:
+      containers:
+        - name: controller
+          resources:
+            requests:
+              cpu: 30m
+---
+# upstream v1.22.0 request: 100m
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: webhook
+  namespace: knative-serving
+spec:
+  template:
+    spec:
+      containers:
+        - name: webhook
+          resources:
+            requests:
+              cpu: 30m