feat(operations): add capacity and resilience gates (#18)

docs/deployment/linux.md

@@ -118,8 +118,11 @@ Keep the host clock synchronized with authenticated NTP. Credential and key
 windows use wall time; lease, timeout, drain, and rate-limit deadlines use a
 monotonic clock. Alert on clock synchronization loss before rotating keys.
 
-Start with the Compose limits (one CPU, 512 MiB, 128 PIDs, 4096 descriptors),
-measure real traffic, then change the limits and the server budgets together.
+The checked-in Compose limits (one CPU and 512 MiB) are for its isolated smoke
+profile, not a production capacity claim. The measured core-state candidate
+uses 2 vCPU and 2 GiB with the same 128-PID/4096-descriptor ceilings; see
+the [capacity and resilience gate](../operations/capacity-and-resilience.md).
+Measure real traffic, then change resource limits and server budgets together.
 Memory pressure or CPU throttling must not extend orchestrator termination past
 `DrainDeadlineSeconds` plus five seconds.
 
@@ -157,8 +160,8 @@ sudo systemctl enable --now rendezvous.service
 Create the dedicated `rendezvous` user without a login shell. Keep
 `/opt/rendezvous` and `/etc/rendezvous` root-owned and non-writable by that user;
 install each required key with `root:rendezvous` ownership and mode `0440`. The
-unit applies the same resource, filesystem, privilege, network-family, and
-shutdown constraints as Compose.
+unit applies the measured 2-vCPU/2-GiB core-state candidate profile plus the
+same filesystem, privilege, network-family, and shutdown hardening as Compose.
 
 ## HTTP and UDP smoke