docs: list the fresh-host prerequisites the smoke campaign surfaced

Close the reconciliation gap from b26de27: the README's prerequisites
section now lists everything the 2026-07 fresh Fedora 44 bring-up
actually required —

- legacy ip_tables/iptable_nat/ip6_tables kernel modules loaded on the
  host (nftables-only Fedora; the rootless node can't modprobe; CNI
  portmap fails without them), with the modules-load.d persist command
- minikube 1.36+ (1.35's registry addon pins a dead gcr.io digest)
- istioctl plus the full Istio distribution at
  ~/.local/share/istio-current (setup-kiali.sh needs samples/addons)
- podman pids_limit alongside the existing inotify note (both are
  checked by the profile setup)

Flip the reconciliation row to verified against that run's blockers,
noting a future fresh-host bring-up from the README alone would
re-confirm end to end.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: patterncatalyst

_plans/reconciliation.md

@@ -18,4 +18,4 @@ The historical reconciliation rows from the capstone era are preserved in
 | **verified** | This repo's `examples/lgtm-datamesh/` tree builds and runs the data-mesh reference end to end, producing the same five-act walkthrough verified in the parent repo as of r28 | `examples/lgtm-datamesh/` | Verified 2026-07-04/05 on a fresh Fedora 44 host (rootless podman, minikube 1.38.1, fresh `capstone` profile): `./scripts/bootstrap-capstone.sh` then `./demos/walkthrough.sh` → 5/5 acts green, twice (once in-order, once in the shuffled suite). Caveats that verification surfaced and this repo fixed: six demo-script bugs (`5403d06`–`e22b318`), plus two host prerequisites the README didn't list — legacy `ip_tables`/`iptable_nat` kernel modules loaded on the host (Fedora is nftables-only; the rootless node can't modprobe), and minikube ≥ 1.36 (1.35's registry addon pins a dead `kube-registry-proxy` digest). |
 | **verified** | Every demo script passes against the bootstrapped stack: all 19 `demos/smoke-*.sh`, the `demo-canary.sh` cycle (up 90/10 → shift 50/50 → down), and the `demo-add-data-product.sh` cycle (up → down) | `examples/lgtm-datamesh/demos/` | Verified 2026-07-04/05, same host: two full-suite runs (24 scripted invocations each) green, with fixes landed and re-verified between them. Fix verification exercised the failure paths live (dead-tunnel port-forward re-attach, gateway wake from scale-to-zero, interceptor cold-start 502 retry). |
 | **verified** | The smokes are order-independent when `scripts/restore-baseline.sh` is run between groups (the smokes' pass-cleanup, CAP-008, otherwise couples them) | `examples/lgtm-datamesh/scripts/restore-baseline.sh` | Verified 2026-07-05: full suite re-run in a deliberately shuffled order (gateway-heavy first, `smoke-order` immediately after the cleanup-happy group — its prior failure position) with `restore-baseline.sh` between groups → all green. The shuffle also exposed one latent race (`smoke-kafka`, fixed in `e22b318`) that two in-order runs had passed on timing. |
-| **unverified** | `README.md`'s "Prerequisites (verified configuration)" section is sufficient for a fresh-host bring-up | `examples/lgtm-datamesh/README.md` | Known gap from the 2026-07 campaign: the section does not list the legacy iptables kernel modules or the minimum minikube version (see the caveats on the first row). Prose update pending; until then the bootstrap fails at tier 1 on a stock Fedora host and the fix commands live in the failure output and LESSONS-LEARNED. |
+| **verified** | `README.md`'s "Prerequisites (verified configuration)" section is sufficient for a fresh-host bring-up | `examples/lgtm-datamesh/README.md` | Gap found in the 2026-07 campaign (missing: legacy iptables kernel modules, minimum minikube version, full Istio distribution for Kiali) and closed 2026-07-05: the section now lists exactly the host state the campaign's fresh Fedora 44 bring-up required. Verified against that run's blockers rather than a second fresh host; a future fresh-host bring-up following only the README would re-confirm end to end. |

examples/lgtm-datamesh/README.md

@@ -85,9 +85,27 @@ RAM-constrained.
 - 64 GB RAM (the `capstone` minikube profile uses 24 GB; the rest is host
   headroom)
 - 1 TB disk (≥30 GB free for image cache + PVs)
-- Kernel `fs.inotify.max_user_instances` raised (the bootstrap checks
-  this and tells you the fix command)
-- Standard tooling: minikube, kubectl, helm
+- Legacy iptables kernel modules loaded on the host. Fedora is
+  nftables-only out of the box, and the rootless minikube node cannot
+  `modprobe` them itself — without them the CNI portmap plugin fails and
+  hostPort pods (the registry proxy first) never start. Load them now
+  and persist across reboots:
+
+  ```bash
+  sudo sh -c 'printf "ip_tables\niptable_nat\nip6_tables\n" \
+      > /etc/modules-load.d/99-kubernetes-iptables.conf'
+  sudo systemctl restart systemd-modules-load
+  ```
+- Kernel `fs.inotify.max_user_instances` raised and podman's default
+  `pids_limit` raised or unlimited (the profile setup checks both and
+  prints the fix commands)
+- Standard tooling: minikube **1.36 or newer** (1.35's registry addon
+  pins a `kube-registry-proxy` image digest that no longer exists on
+  gcr.io, so the addon can never come up), kubectl, helm, istioctl —
+  with the full Istio distribution unpacked at
+  `~/.local/share/istio-current` (`setup-kiali.sh` applies
+  `samples/addons/kiali.yaml` from it; the `istioctl` binary alone is
+  not enough)
 
 The bootstrap script audits prerequisites before doing any work.