[JAORMX]

Scope

Add operator-controlled nodeSelector and bounded tolerations to strict executor profiles. Profile scheduling is validated and included in the immutable digest only when nonempty; existing digests remain unchanged. Executor Pods receive profile scheduling and bounded default NoExecute tolerations, and reconciliation rejects unexpected selectors, tolerations, or affinity. RuntimeClasses that add admission scheduling fail profile preflight rather than silently changing profile identity. The chart schema and existing operator guide are updated in place.

This is the requested narrow implementation-only slice from main at 0c2dc2713. The broad untracked operations plan and ADR drafts are not a baseline or part of this PR. No CRD, public API, arbitrary Pod template, model-selected scheduling, or live cluster change is included. Retained Helm lifetime rejects profile changes; it does not adopt or rewrite allocations.

Checks

• Focused execution-controller and rendered-chart tests, including profile drift, observed-Pod mutation, strict schema, and retained lifetime: passed.
• Helm lint and template with synthetic values: passed; no cluster used.
• task lint, task test, task test:race, task docs, task site:build: passed on the committed candidate (full test/race/docs in isolated clean worktrees so unrelated pre-existing untracked drafts do not enter test discovery).
• go run ./cmd/mecademo: passed (Read tool, permission ask/approval, Write result).

Review covered Kubernetes operator/deployment, security, architecture, duplication, and test adequacy. Findings about RuntimeClass admission, configurable default-toleration duration, schema/profile mismatch, and chart lifecycle were addressed. The upstream Kubernetes DefaultTolerationSeconds admission implementation was checked for the exact key/effect matching used in the controller. Existing cluster admission is trusted as an operator-controlled component; the provider does not assert protection against a malicious mutating webhook.

Note: the first task test in the original worktree failed on pre-existing untracked ADR 0370 and .worktrees/ test discovery; it passed from the clean committed worktree. The first race run timed out at 600 seconds while tests were still passing; the rerun completed successfully. task site:build passed with existing Node engine and npm-audit warnings.