chore: broken-kit=P0 rule + CNI validation test plan/results

[rustyrazorblade]

Saves two things before picking #805 back up tomorrow:

• CLAUDE.md: codifies that a broken kit (failed install/start/health) is ALWAYS a P0 — never deferred, never scoped out.
• test-plans/cni-flannel-cilium-validation.md + -results.md: the two-CNI acceptance plan (every kit, both CNIs) and the partial results from the run (Flannel fully passed; Cilium blocked on the kpr=false hostNetwork→ClusterIP gap — see perf(networking): make Cilium native routing (eBPF) the default — resolve the worker-bootstrap deadlock #805).
• gitignores stray nohup.out / build logs.

Docs/process only — no code. Separate from PR #820 (the #805 implementation).

[github-actions]

Code Coverage

Total Project Coverage	73.28%	❌

[claude]

Reviewed — this is a docs/process-only PR (no code changes), so most of the usual review dimensions (code quality, perf, security) don't apply. A few notes:

Inconsistency with test-plans/CLAUDE.md

test-plans/CLAUDE.md mandates that "every plan must ... [c]reate the workspace directory and run bin/create-easy-db-lab-wrapper as its first step," with a literal bash block (CLUSTER_DIR=...; mkdir -p ...; bin/create-easy-db-lab-wrapper ...; EDB=...). Every other file in test-plans/ (e.g. cassandra-5.0-validation-full.md, postgres-kit-validation.md, clickhouse-validation-full.md) includes that literal block as step 1.

test-plans/cni-flannel-cilium-validation.md only mentions the wrapper in prose under "Preconditions" ("Cluster workspace + $EDB wrapper per CLAUDE.md...") and jumps straight to $EDB init ... as "Steps 1." in both phases — there's no actual CLUSTER_DIR=/mkdir -p/bin/create-easy-db-lab-wrapper/EDB= snippet anywhere in the file. Worth adding the literal block to match the convention (and so the plan is directly copy-pasteable via /easy-db-lab:run, consistent with every sibling plan).

Minor / non-blocking

• The results doc notes a Cilium cluster was "left UP as evidence" (clusters/cni-cilium-retry-20260720-171324). Since this is being merged to docs now and picked back up "tomorrow," just flag for yourself that this is a live AWS cluster incurring cost until perf(networking): make Cilium native routing (eBPF) the default — resolve the worker-bootstrap deadlock #805/perf(networking): Cilium ENI native routing as opt-in --cni=cilium datapath #820 work resumes and it's torn down.
• New CLAUDE.md rule (broken kit = P0) reads clearly and is consistent with the existing "never disable functionality" rule directly above it. Good pairing.
• .gitignore additions (nohup.out, build-image.log, build-cassandra.log) are sensible and none of these are currently tracked, so no risk of accidentally un-tracking committed files.

Everything else — the CNI matrix, root-cause writeup for the kubeProxyReplacement=false hostNetwork→ClusterIP gap, and the CNI-independent kit findings (tidb dead helm repo, trino config rejection) — is well-documented and clearly separates #805-specific issues from pre-existing kit bugs. Nothing else to flag.