Use lightweight cluster topology in CI

ci/README.md

@@ -6,8 +6,12 @@ read-only host mounts because the CIS checks inspect processes, permissions,
 and node configuration. The job is intentionally separate from the ArgoCD
 application tree so the scanner cannot become part of the workload baseline.
 
-GitHub Actions creates the local cluster, runs the job, stores the JSON report,
-and prints pass, warn, and fail totals in the workflow summary. The workflow
+GitHub Actions creates a disposable one-server K3s cluster, runs the job,
+stores the JSON report, and prints pass, warn, and fail totals in the workflow
+summary. The CI topology is intentionally smaller than the developer
+quick-start topology so it remains reliable on shared runners.
+
+The workflow
 fails if the scanner job or report generation fails. It does not yet fail on
 CIS findings because a vanilla K3d cluster is expected to produce findings;
 later hardening phases can turn selected controls into merge gates.
@@ -55,4 +59,3 @@ docker run -d \
 Mounting the Docker socket gives workflow jobs substantial control over the
 runner host. Use a dedicated disposable runner, restrict its repository scope,
 and avoid placing unrelated credentials on that host.
-

ci/k3d-ci-cluster-config.yaml

@@ -0,0 +1,24 @@
+apiVersion: k3d.io/v1alpha5
+kind: Simple
+metadata:
+  name: security-baseline-ci
+
+# CI only needs one control-plane node for the K3s CIS scan. Keeping agents
+# out of this disposable job avoids unnecessary Docker resource pressure on
+# shared GitHub or Gitea runners.
+servers: 1
+agents: 0
+
+options:
+  k3s:
+    extraArgs:
+      - arg: --disable=traefik
+        nodeFilters:
+          - server:*
+  k3d:
+    wait: true
+    timeout: 180s
+  kubeconfig:
+    updateDefaultKubeconfig: true
+    switchCurrentContext: true
+