docs(P00): research findings — v0.14 ingress bootstrap

7 research topics: nft SNAT masquerade syntax, pve-firewall
coexistence (priority collision fix), podman-in-LXC (fuse=1
requirement), traefik v3.3 TLS model (certResolver does not exist —
use dynamic tls.certificates), pct create floating-IP syntax, podman
restart persistence (podman-restart.service), SELinux :Z omission.

Key findings that change the plan:
- nft postrouting: ip saddr 127.0.0.0/8 oifname != lo masquerade
- nft first-apply: pre-create table before nft -f
- pve-firewall: shift orca input/forward to priority -10
- LXC features: nesting=1,keyctl=1,fuse=1 (fuse=1 for fuse-overlayfs)
- traefik TLS: drop certResolver: orca, use dynamic tls.certificates
- podman: --restart=unless-stopped + enable podman-restart.service
- volumes: omit :Z flag, use :ro on both mounts

---ci---
project: orca
phase: 0
milestone: v0.14
status: research
---/ci---

.ciagent/CHECKPOINT.json

@@ -1,6 +1,6 @@
 {
   "phase": 0,
-  "stage": "clarify",
+  "stage": "research",
   "milestone": "v0.14",
   "milestone_slug": "ingress-bootstrap",
   "phase_role": "pre_execution",

.ciagent/PERSONAS.md

@@ -10,41 +10,47 @@ deactivated:
   - network-engineer
   - devops-engineer
 phase_specific:
-  - uat-engineer (P12 only)
+  - release-engineer (P1 only — Dockerfile.traefik + release pipeline)
 reason: |
-  Orca v0.13 is a production-hardening milestone. The active roster is
-  trimmed to the four personas that own the hardening work:
-  - lead-developer: coordinates phase decomposition, owns scheduler
-    wiring (R-022) and jobspec parser fixes (P03)
-  - backend-engineer: owns ACL enforcement wiring (R-023), injection
-    hardening (P02), transport/SSH safety (P08), concurrency (P07)
-  - data-engineer: owns SQLite busy_timeout, audit chain race fix,
-    migration safety, DB retention (P05, P07, P09)
-  - security-engineer: owns toolchain vulns (P01), seal/audit CLI
-    (P05), auth init-idp (P06), key zeroing, WebAuthn reg auth (P04)
-  
+  Orca v0.14 is the ingress bootstrap completeness milestone. The active
+  roster owns the podman-traefik container + nft SNAT/DNAT + proxmox LXC
+  ingress work:
+  - lead-developer: coordinates phase decomposition, owns podman traefik
+    reconciler (P2), nft emitter extension (P3), init/bootstrap wiring (P3,P4)
+  - backend-engineer: owns Dockerfile.traefik + release pipeline (P1),
+    proxmox native ingress mode (P5), floating-IP LXC provisioning (P6),
+    doctor ingress (P7)
+  - data-engineer: owns IngressMode schema migration (P5), node record
+    updates for floating-IP LXC registration (P6)
+  - security-engineer: owns nft priority collision fix (pve-firewall
+    coexistence), step-ca root CA push to nodes, TLS model change
+    (certResolver → dynamic tls.certificates)
+
   network-engineer and devops-engineer are deactivated — their territory
-  (nft ruleset, collector scripts) is covered by backend-engineer in
-  this milestone. cli-engineer and frontend-engineer remain deactivated
-  (no CLI framework or UI work).
-  
-  uat-engineer is phase-specific for P12 (UAT plan + signoff script).
-  
+  (nft ruleset, container deployment) is covered by backend-engineer +
+  lead-developer in this milestone. cli-engineer and frontend-engineer
+  remain deactivated (no CLI framework or UI work).
+
+  release-engineer is phase-specific for P1 (Dockerfile.traefik +
+  release.sh + .coreci.yml container-publish-traefik step).
+
   Territory enforcement is warn mode (config.json
   personas.territory_enforcement=warn). Cross-territory fixes (e.g. a
-  fix that touches both daemon handlers and SQLite) are allowed with a
-  warning.
+  fix that touches both nft emitter and proxmox bootstrap) are allowed
+  with a warning.
 
   Framework alignment (from go.mod):
   - lead-developer: cobra
-  - backend-engineer: cobra, connectrpc
+  - backend-engineer: cobra, podman (CLI), pct (CLI via SSH)
   - data-engineer: modernc/sqlite
-  - security-engineer: go-webauthn, go-jose, x/crypto
-  - uat-engineer: bash, bats
+  - security-engineer: nft, step-ca, TLS
+  - release-engineer: docker, .coreci.yml
 
   Constraint alignment:
   - All personas: offline-first, no-redundant-implementations
-  - backend-engineer: API-first, error-handling, security-first
+  - backend-engineer: API-first, error-handling, security-first,
+    container-first (R-024)
   - data-engineer: schema-first, migration-safe, local-storage-only
-  - security-engineer: deny-by-default, zero-trust, no-passwords (R-021)
-  - uat-engineer: idempotent, read-only, claim-coverage
+  - security-engineer: deny-by-default, zero-trust, no-passwords (R-021),
+    pve-firewall-coexistence
+  - release-engineer: per-release-tagging, registry-auth