add Kyverno and Falco security test workloads

scripts/proxmox/create-flatcar-k3d-test-host.sh

@@ -17,6 +17,7 @@ Required environment variables:
 Optional environment variables:
   VM_NAME               VM name, default flatcar-k3d-test
   CORES                 CPU cores, default 4
+  CPU_TYPE              Proxmox CPU model, default host passthrough
   MEMORY_MB             Memory in MiB, default 16384
   DISK_SIZE             Final disk size, default 100G
   BRIDGE                Proxmox bridge, default vmbr0
@@ -56,6 +57,7 @@ done
 
 VM_NAME="${VM_NAME:-flatcar-k3d-test}"
 CORES="${CORES:-4}"
+CPU_TYPE="${CPU_TYPE:-host}"
 MEMORY_MB="${MEMORY_MB:-16384}"
 DISK_SIZE="${DISK_SIZE:-100G}"
 BRIDGE="${BRIDGE:-vmbr0}"
@@ -181,6 +183,7 @@ qm create "$VM_ID" \
   --name "$VM_NAME" \
   --ostype l26 \
   --cores "$CORES" \
+  --cpu "cputype=$CPU_TYPE" \
   --memory "$MEMORY_MB" \
   --net0 "virtio,bridge=$BRIDGE" \
   --ipconfig0 ip=dhcp \

scripts/proxmox/k3d-test-host.md

@@ -8,6 +8,9 @@ The default profile is 4 CPU cores, 16 GiB memory, and a 100 GiB disk. The
 Ignition configuration enables Docker, creates `/opt/k3d-test/workspace`, and
 installs pinned k3d and kubectl binaries on first boot.
 
+The VM defaults to Proxmox CPU passthrough. This is important for Falco and
+modern container images that require x86-64-v2 CPU features.
+
 Enable snippets on the Proxmox storage first:
 
 ```bash