v0.52.0: operator-opt-in CPU/RAM cap for the provisioned guest (-cores/-memory)

New -cores N / -memory M (MiB) flags for --selftest=bring-up|provision (0 = keep
golden default), flowed through bringUpSizing into reconcile.BringUpSpec so the
existing buildBringUpConfig emits cores/memory into the pre-start config PUT (the
cap lands before first boot). No engine change. New pure-function test
TestBuildBringUpConfig_ResourceCaps asserts the set + omit-when-zero cases
(red-proof run + reverted). go build/vet/test clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -238,6 +238,11 @@ so cleanly if the token/endpoint isn't configured.
 `--selftest=task --vmid N` (explicitly gated) exercises `WaitTask` on a **reversible** op
 (snapshot → rollback → delete-snapshot) against guest `N`. Default `--selftest` never mutates.
 
+`--selftest=bring-up|provision` accept an optional operator **CPU/RAM cap**: `-cores N` and
+`-memory M` (MiB). Both default to `0` = keep the golden's baked sizes. When set, the cap is written
+into the SAME pre-start config PUT as the identity reset (via `BringUpSpec.Cores/MemoryMB`), so the
+guest never boots uncapped — useful when the appliance shares a host with other guests.
+
 ## Process model
 
 Native Go binary, systemd service, **non-root** `felhom-agent` service user holding the scoped token,