feat(loadtest): load-test tooling + capacity model

boot-labs.js drives the real admin Prepare-Labs endpoint (reusing the
existing session-helper.js from Phase 3A) and records boot time/failure
rate; sample-resources.sh samples real docker stats for running Labs.
capacity-model.js turns measured per-Lab CPU/memory into a recommended/
warning/hard-admission-control concurrency threshold - no concurrency
number is hardcoded as a marketing figure, every input is explicitly
placeholder data until measured against the real host.

Plus deploy/rollback/smoke-test scripts used by the CI/CD and deployment
runbooks. All syntax-checked; validate-compose.sh and capacity-model.js
actually run against real inputs.

infra/scripts/loadtest/sample-resources.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Run on rn-lab-host-01 (or the local dev machine running the Lab containers) WHILE
+# boot-labs.js is running, to capture real per-Lab CPU/RAM/disk usage — `docker stats` is the
+# ground truth here, not an estimate. Samples every 5s for the given duration and writes CSV.
+set -euo pipefail
+DURATION_SEC="${1:-120}"
+OUT="${2:-./results/resource-sample-$(date +%s).csv}"
+mkdir -p "$(dirname "$OUT")"
+
+echo "timestamp,container,cpu_pct,mem_usage,mem_pct,net_io,block_io,pids" > "$OUT"
+END=$(( $(date +%s) + DURATION_SEC ))
+while [ "$(date +%s)" -lt "$END" ]; do
+  docker stats --no-stream --format '{{.Name}},{{.CPUPerc}},{{.MemUsage}},{{.MemPerc}},{{.NetIO}},{{.BlockIO}},{{.PIDs}}' \
+    | grep -E '^rootnode-lab-' \
+    | while IFS=, read -r name cpu mem memp net block pids; do
+        echo "$(date -u +%Y-%m-%dT%H:%M:%SZ),$name,$cpu,$mem,$memp,$net,$block,$pids" >> "$OUT"
+      done
+  sleep 5
+done
+
+echo "Written to $OUT"
+echo "Summarize with: awk -F, 'NR>1{print \$2}' $OUT | sort -u   # containers seen"