GRE-225: Protect and diagnose shared-host workloads

[HeadCase]

Summary

• apply relative CPU, I/O, and OOM priorities across ObsCam, MediaMTX, AllSky, and background sync
• install bounded fail-soft shared-host diagnostics and fail-closed memory-controller verification
• document operations and the completed real-hardware combined-load qualification

Verification

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --all-targets --all-features
• cargo deny check
• cargo machete
• npm test
• npm run typecheck:browser
• shell syntax and executable behavior suites
• systemd-analyze verify
• git diff --check
• parallel standards and specification reviews: no findings

shellcheck is unavailable on the Pi; sh -n and the executable shell fixtures passed.

Hardware qualification

Five concurrent WebRTC viewers advanced with zero discarded frames while the genuine synchronization path and AllSky remained healthy. After enabling the cgroup v2 memory controller and rebooting, ObsCam and MediaMTX exposed enforceable high/max thresholds, all long-running services retained zero restarts, WireGuard and genuine mounts remained healthy, and the final thermal sample was 67.2 C with throttled=0x0.

Closes GRE-225