chore: raise code queue memory budget

docs/reference/cicd-standardization.md

@@ -2,6 +2,8 @@
 
 This document defines the stable split between CI artifact producers, artifact catalog data, legacy guardrails and CD consumers. Detailed Tekton rules remain in `docs/reference/ci.md`; registry runtime and consumers remain in `docs/reference/artifact-registry.md`; user-service delivery order remains in `docs/reference/user-service-delivery.md`.
 
+`deploy.json` is the single release-intent source for deployment-time parameters that must stay aligned across CI/CD, dev and prod consumers, and runtime health checks. Other files and manifests may mirror those values for wiring or compatibility, but they must be derived from `deploy.json` and not become a second source of truth. The long-term standardization work is tracked in [GitHub issue #60](https://github.com/pikasTech/unidesk/issues/60).
+
 ## Target Shape
 
 The standard release shape is:

docs/reference/user-service-delivery.md

@@ -36,6 +36,7 @@ The default release flow for a user-service change is:
 - No production deploy may rebuild the source from a dirty worktree.
 - Commit-pinned image tags are the deployment truth; mutable `latest` tags are not.
 - Root `CI.json` is an artifact catalog only. It lists CI producer inputs such as `serviceId`, artifact kind, source repository, repo-relative Dockerfile, image repository naming, upstream image digest/mirror metadata and the required artifact summary fields; it must not carry runtime topology or replace `deploy.json`.
+- `deploy.json` is the only release-intent source for desired commits, image pins and deployment-time parameters that must stay consistent across CI, dev CD and prod CD. Runtime manifests, health metadata and helper config may mirror those values only as derived copies; if they diverge, `deploy.json` wins. The consolidation track is [GitHub issue #60](https://github.com/pikasTech/unidesk/issues/60).
 - The standard CI artifact producer is `bun scripts/cli.ts ci publish-user-service --service <id> --commit <full-sha>`. It accepts only a pushed Git commit and a service id registered in `CI.json`, reads `source.repo` and `source.dockerfile` from that catalog, rejects ad hoc `--repo` overrides, and reports `serviceId`, `sourceCommit`, `sourceRepo`, `dockerfile`, `imageRef`, `tag`, `digest` and `digestRef`.
 - The producer dry-run preflight is `bun scripts/cli.ts ci publish-user-service --service <id> --commit <full-sha> --dry-run`. It is read-only and reports detailed `missingChannels` plus stable `missingControlChannels` for `backend-core`, `database`, `provider` and `registry`; any missing control channel is `runnerDisposition=infra-blocked`. The `controlledPublish` field names D601 `unidesk-ci` as the only controlled environment for the subsequent real publish.
 - The CI artifact producer is not a deploy executor. It must not mutate the production namespace, restart production services, or update `deploy.json`.

src/components/microservices/code-queue/docker-compose.d601.yml

@@ -8,8 +8,8 @@ services:
         CODE_QUEUE_BASE_IMAGE: ${CODE_QUEUE_BASE_IMAGE:-oven/bun:1-debian}
     container_name: code-queue-backend
     restart: unless-stopped
-    mem_limit: "${CODE_QUEUE_MEM_LIMIT:-3g}"
-    memswap_limit: "${CODE_QUEUE_MEMSWAP_LIMIT:-4g}"
+    mem_limit: "${CODE_QUEUE_MEM_LIMIT:-15g}"
+    memswap_limit: "${CODE_QUEUE_MEMSWAP_LIMIT:-16g}"
     env_file:
       - path: ${CODE_QUEUE_ENV_FILE:-../../../../.state/code-queue-d601.env}
         required: false

src/components/microservices/k3sctl-adapter/k3s/code-queue.k8s.yaml

@@ -1141,9 +1141,9 @@ spec:
           resources:
             requests:
               cpu: 250m
-              memory: 512Mi
+              memory: 15Gi
             limits:
-              memory: 4Gi
+              memory: 15Gi
       volumes:
         - name: docker-sock
           hostPath: