feat: release pipeline, k3s manifests, infra k3s bootstrap

- scripts/release.sh: full release orchestration (build, publish, install)
- deploy/k3s/: Deployment, ConfigMap, PVC, Namespace with kustomize
  hostNetwork for dnsmasq, NET_ADMIN caps, local-path PVC
- Infra role gets /var/lib/rancher partition (20GB, preserved on reprovision)
  for k3s etcd data persistence across reinstalls
- Infra %post installs k3s server (INSTALL_K3S_SKIP_START=true)
- 5 new kickstart tests (27 total)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bastion/src/bastion/src/templates/install.ks.ts

@@ -35,6 +35,7 @@ export function renderInstallKickstart(params: InstallKickstartParams): string {
   const vg = "labvg";
   const now = new Date().toISOString();
   const hasLonghorn = role === "worker";
+  const hasRancher = role === "infra";
 
   // -- Auth section --
   const auth = sshKeys.length > 0
@@ -91,6 +92,11 @@ done
     ? `logvol /var/lib/longhorn --vgname=${vg} --name=longhorn --fstype=xfs --grow --size=1`
     : "";
 
+  // -- Rancher LV for fresh install (infra role) --
+  const rancherFreshLine = hasRancher
+    ? `logvol /var/lib/rancher --vgname=${vg} --name=rancher --fstype=xfs --size=20480`
+    : "";
+
   return `# Lab Bastion -- Fedora ${fedoraVersion} server install
 # Generated: ${now}
 # Target: ${fqdn} (role=${role})
@@ -140,12 +146,13 @@ if vgs $VG &>/dev/null; then
     REPROVISION=yes
 
     # Detect which data LVs to preserve
-    PRESERVE_LONGHORN=no; PRESERVE_SRV=no; PRESERVE_HOME=no
+    PRESERVE_LONGHORN=no; PRESERVE_SRV=no; PRESERVE_HOME=no; PRESERVE_RANCHER=no
     lvs $VG/longhorn &>/dev/null && PRESERVE_LONGHORN=yes
     lvs $VG/srv      &>/dev/null && PRESERVE_SRV=yes
     lvs $VG/home     &>/dev/null && PRESERVE_HOME=yes
+    lvs $VG/rancher  &>/dev/null && PRESERVE_RANCHER=yes
 
-    echo "Preserving: longhorn=$PRESERVE_LONGHORN srv=$PRESERVE_SRV home=$PRESERVE_HOME"
+    echo "Preserving: longhorn=$PRESERVE_LONGHORN srv=$PRESERVE_SRV home=$PRESERVE_HOME rancher=$PRESERVE_RANCHER"
 
     # Remove only OS logical volumes (keep data LVs)
     for lv in root var varlog swap; do
@@ -191,6 +198,10 @@ PARTEOF
         echo "logvol /var/lib/longhorn --vgname=${vg} --name=longhorn --useexisting --noformat" >> /tmp/part.ks
     fi
 
+    if [ "$PRESERVE_RANCHER" = "yes" ]; then
+        echo "logvol /var/lib/rancher --vgname=${vg} --name=rancher --useexisting --noformat" >> /tmp/part.ks
+    fi
+
 else
     # Fresh install
     cat > /tmp/part.ks << PARTEOF
@@ -207,6 +218,7 @@ logvol /var/log --vgname=${vg} --name=varlog --fstype=xfs --size=10240
 logvol /home --vgname=${vg} --name=home --fstype=xfs --size=10240
 logvol /srv --vgname=${vg} --name=srv --fstype=xfs --size=20480
 ${longhornFreshLine}
+${rancherFreshLine}
 PARTEOF
 fi
 
@@ -357,7 +369,9 @@ cat > /root/README << 'README'
 #      curl -sfL https://get.k3s.io | K3S_URL=https://<server>:6443 K3S_TOKEN=<token> sh -
 README
 
-IP_ADDR=$(ip -4 addr show | awk '/inet / && !/127.0.0/ {split($2,a,"/"); print a[1]; exit}')
+${hasRancher ? `# Install k3s server (skip start - will be configured manually)
+curl -sfL https://get.k3s.io | INSTALL_K3S_SKIP_START=true sh -
+` : ""}IP_ADDR=$(ip -4 addr show | awk '/inet / && !/127.0.0/ {split($2,a,"/"); print a[1]; exit}')
 bastion_progress "complete" "ready at $IP_ADDR"
 
 %end

bastion/src/bastion/tests/kickstart.test.ts

@@ -93,6 +93,35 @@ describe("renderInstallKickstart", () => {
     expect(ks).toContain("http://10.0.0.5:9090/api/progress");
   });
 
+  it("infra role has /var/lib/rancher partition", () => {
+    const ks = renderInstallKickstart(baseParams({ role: "infra" }));
+    expect(ks).toContain("logvol /var/lib/rancher --vgname=labvg --name=rancher --fstype=xfs --size=20480");
+  });
+
+  it("infra role has k3s install", () => {
+    const ks = renderInstallKickstart(baseParams({ role: "infra" }));
+    expect(ks).toContain("curl -sfL https://get.k3s.io | INSTALL_K3S_SKIP_START=true sh -");
+  });
+
+  it("worker role does NOT have /var/lib/rancher partition in fresh install", () => {
+    const ks = renderInstallKickstart(baseParams({ role: "worker" }));
+    // Worker should not have the fresh-install rancher partition line
+    expect(ks).not.toContain("logvol /var/lib/rancher --vgname=labvg --name=rancher --fstype=xfs --size=20480");
+  });
+
+  it("worker role does NOT have k3s install", () => {
+    const ks = renderInstallKickstart(baseParams({ role: "worker" }));
+    expect(ks).not.toContain("INSTALL_K3S_SKIP_START");
+  });
+
+  it("reprovision preserves rancher partition", () => {
+    const ks = renderInstallKickstart(baseParams({ role: "infra" }));
+    expect(ks).toContain("PRESERVE_RANCHER=no");
+    expect(ks).toContain('lvs $VG/rancher');
+    expect(ks).toContain("PRESERVE_RANCHER=yes");
+    expect(ks).toContain('logvol /var/lib/rancher --vgname=labvg --name=rancher --useexisting --noformat');
+  });
+
   it("partition sizes are correct", () => {
     const ks = renderInstallKickstart(baseParams());
     // root = 33792