CUST-WP-0071-T05: in-cluster weekly allocation runner (source only)

Stdlib-only CronJob entry point that reads the Kubernetes API (get/list on
nodes, pods, PVCs, PVs, storageclasses, metrics.k8s.io) and Prometheus, reuses
build_observation / reconcile.join / build_report / retain unchanged, and
retains ISO-week reports, per-attempt inputs and an append-only receipt log.
Telemetry window ends Monday 06:00 UTC so weeks stay comparable across DST.
Reconcile now imports PyYAML only in its CLI. Not deployed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/weekly-allocation-report.md

@@ -112,3 +112,42 @@ The tests cover historical namespace-only input, missing/zero/NaN, invalid
 aggregation, query failure, compatible/incompatible periods, stable identities
 and owner-task links, stale/future evidence, owner review, resource/capture
 mismatch and retained retry/collision behavior.
+
+## In-cluster runner (CUST-WP-0071-T05, founder decision 2026-10-21)
+
+`docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md` selects an
+in-cluster Kubernetes CronJob for T05 and supersedes the Activity Core
+placement above. `scripts/weekly_allocation_incluster.py` is the job entry
+point. It is standard-library only and reuses the existing owner code
+unchanged: railiance-cluster `build_observation`, `reconcile.join` (PyYAML is
+now imported only by the reconcile CLI) and this adapter's `build_report` and
+`retain`.
+
+- Reads: the Kubernetes API through the pod ServiceAccount, with get/list on
+  nodes, pods, persistentvolumeclaims, persistentvolumes, storageclasses and
+  metrics.k8s.io nodes/pods only. Prometheus is reached through
+  `PROMETHEUS_URL` with `config/weekly-allocation-queries.json`.
+- Week identity: the ISO week of (run time - 6h). The telemetry window ends at
+  Monday 06:00 UTC, so consecutive windows are exactly seven days apart in CET
+  and CEST. Prometheus keeps seven days of data, so the run must happen on the Monday. A
+  2026-10-21 (Wednesday) read-only dry run against railiance01 retained the
+  report, but per-namespace CPU sample counts reached at most 1512 of 2016,
+  because the window start had already expired.
+- Retention: `<data>/reports/<YYYY>-W<ww>.json` (create-without-replacement),
+  per-attempt inputs under `<data>/runs/<week>/<attempt>/`, and an append-only
+  `<data>/receipts.jsonl` with status `retained`, `already-retained` or
+  `failed`, previous week, `missed_weeks`, comparability and failed queries.
+- Idempotency: a retained week is a no-op success. A failed attempt leaves no
+  report, so the Job retry or a manual run collects again.
+- Not done: delivery, owner acknowledgment and owner-task creation
+  (`delivery: not emitted`). Workload rows stay `investigate` because the queries
+  are namespace-level. kube-state-metrics does not export `kube_pod_labels`, so
+  no workload-labelled series exist yet.
+
+Executor manifests (suspended, not registered with ArgoCD) live in
+railiance-platform `argocd/platform-addons/custodian-allocation-review/`, with
+the draft Application in `argocd/railiance01/drafts/`.
+
+```sh
+python3 -m pytest tests/test_weekly_allocation_incluster.py tests/test_weekly_allocation_report.py -q
+```