nodes.md: the update-harness bench (LXC 9401 on demo-hp) was in no document

A session that needs the swap-0 venue for checklist 5.1 had to find it with
pct list, and a brief this week placed it on the wrong host. Now recorded where
such facts live: which host, why swap is 0, that it is normally stopped, what it
keeps in /opt/upg between runs, and that its images are not pruned.

documentation/operations/nodes.md

@@ -218,6 +218,23 @@ Details, and the two hard rules that apply to any host node, in `operations/tail
   the unprivileged mapping (100000), seed `controller.yaml` (hub/tunnel/agent/off-site off) and a
   claimed `settings.json`, then start `felhom-controller-bootstrap.service`.
 
+### demo-hp update-harness guest — LXC 9401 `upgrade-harness`
+
+- **Disposition:** the **bench** — the venue every `scripts/upgrade-test.py` run uses. It is a plain
+  Docker host with no controller, no agent and no hub: the harness renders a catalog template, runs
+  `docker compose` directly and measures the result. Apps on it are throwaways.
+- **Where it lives, because a brief got this wrong on 2026-10-10:** on **demo-hp**, beside 9202.
+  felhom-pve (`demo-felhom`) carries only guest 9201. Read with `pct list` on both hosts.
+- **Shape:** 6 cores, 10 240 MB, **swap 0 — that is the point**: checklist 5.1 wants a first start
+  with no swap to hide a peak, and 9202 has 512 MB of swap. Rootfs 60 G on `nvme-scratch`,
+  unprivileged with `nesting=1,keyctl=1`. Debian 13, Docker 26.1.5.
+- **Normally STOPPED.** A session starts it (`pct start 9401`), works, and stops it again. It keeps
+  `/opt/upg` between runs: the harness scripts and a `templates/` copy, synced from a catalog
+  checkout before each campaign. `/opt/templates` is a symlink to `/opt/upg/templates`, added
+  2026-10-10 so `check-volume-persistence.py` — which resolves its root as the script's
+  grandparent — finds the templates when it is run from `/opt/upg`.
+- **Images are kept, never pruned.** Re-pulling an app's image set costs minutes per edge, and the
+  standing rule against global Docker cleanup applies here as everywhere.
 ## What is NOT enrolled here (deliberately)
 
 - **No PBS datastore, no offsite target** on demo-hp; the DR tier is the N100's.