uat: the harness's cluster is declared, and the health check stops racing the restart

.gitignore

@@ -1 +1,3 @@
 site/
+uat/cluster/node_modules/
+uat/cluster/dist/

docs/kubemicrovm.md

@@ -14,6 +14,7 @@ What it will not tell you is whether your code runs. m80 emulates the control pl
 | [k3d](https://k3d.io) | Creates the cluster |
 | kubectl | The scripts drive the cluster with it |
 | helm | cert-manager and the operator chart both install with it |
+| node + npm | The cluster's shape is declared (`uat/cluster/cluster.ts`, a self-contained chant mini-project); the harness builds the k3d config from it. m80 itself stays a single Go binary — this is harness infrastructure, not m80's |
 | A [KubeMicroVM](https://github.com/codriverlabs/KubeMicroVM) checkout | Only for running their UAT suite; not needed to bring the stack up |
 
 The AWS CLI is not needed on the host. It ships inside the runner container.
@@ -106,7 +107,7 @@ Worth stating because it reads the other way round at first glance: **the MicroV
 
 Nor does this harness need the S3 bucket or the IAM build role to exist. m80 accepts both as opaque strings and fetches nothing, so every case here passes against a bucket that was never created. Validating the provisioning of those prerequisites is a real and separate job, and [docs/floci.md](floci.md) says which layer does it.
 
-Every default is an environment variable: `CLUSTER`, `NS`, `M80_IMAGE`, `CHART_VERSION`, `REGION`, `MAX_ACCOUNT_MEMORY_MIB`. Read the top of `uat/up.sh` for the current values.
+Every default is an environment variable — `NS`, `M80_IMAGE`, `CHART_VERSION`, `REGION`, `MAX_ACCOUNT_MEMORY_MIB` — except the cluster itself, whose name and shape are declared in `uat/cluster/cluster.ts` and built into the config `k3d cluster create --config` consumes. Read the top of `uat/up.sh` for the current values.
 
 To test a build of your own, `M80_IMAGE=m80:candidate ./uat/up.sh` — a locally built image is imported into the cluster rather than pulled.
 

uat/cluster/chant.config.ts

@@ -0,0 +1,18 @@
+import type { ChantConfig } from "@intentius/chant";
+
+/**
+ * The smallest chant project that can exist: one declarable, one lexicon.
+ *
+ * m80 itself is a single Go binary with no companions, and stays that way —
+ * this directory is the UAT *harness's* infrastructure, not m80's. The
+ * harness's k3d cluster was the one piece of it spelled as CLI flags; now
+ * the flags are data and `k3d cluster create --config` consumes what
+ * `chant build` emits. node/npm join the harness prerequisites (they were
+ * already nowhere near the binary), and the emitted YAML is a file the
+ * native tool accepts with chant nowhere in sight.
+ */
+export default {
+  lexicons: ["k3d"],
+  sourceDir: ".",
+  ownership: { stack: "m80-uat", env: "uat" },
+} satisfies ChantConfig;

uat/cluster/cluster.ts

@@ -0,0 +1,27 @@
+/**
+ * The UAT cluster, declared.
+ *
+ * `uat/up.sh` used to spell this as flags (`--agents 1`); the shape is data
+ * now, faithful to what the script always created — loadbalancer included,
+ * because trimming it would be a change, not a port. chant stamps its
+ * ownership marker onto every node's Docker labels on the way through.
+ *
+ * The kubeconfig block restores k3d's own default behaviour explicitly:
+ * merge into the default kubeconfig and switch to it. This harness is a
+ * delete-and-recreate flow whose every kubectl call expects the ambient
+ * context to be the cluster it just made — the switch is the point, so it
+ * is declared rather than inherited.
+ */
+import { Cluster, KubeconfigOptions, Options } from "@intentius/chant-lexicon-k3d";
+
+export const uatCluster = new Cluster({
+  metadata: { name: "m80-uat" },
+  servers: 1,
+  agents: 1,
+  options: new Options({
+    kubeconfig: new KubeconfigOptions({
+      updateDefaultKubeconfig: true,
+      switchCurrentContext: true,
+    }),
+  }),
+});