feat: surface g14 observability resource snapshot

scripts/src/hwlab-g14.ts

@@ -5681,6 +5681,7 @@ function closeoutAdvice(summary: Record<string, unknown>): string[] {
   if (summary.scrapeReachable !== "pass") advice.push("scrapeReachable failed -> check ServiceMonitor labels, metrics sidecar port name, and Prometheus target discovery");
   if (summary.sidecarServing !== "pass") advice.push("sidecarServing failed -> check hwlab-metrics sidecar readiness, restartCount, and metrics script/container logs");
   if (summary.businessHealthProbe !== "pass") advice.push("businessHealthProbe failed -> up=1 but health_probe=0 usually means sidecar can be scraped but cannot reach the business health endpoint");
+  if (summary.resourceSnapshot !== "pass") advice.push("resourceSnapshot failed -> check metrics.k8s.io APIService and metrics-server availability on G14 k3s");
   if (summary.namespaceControlPlaneBoundary !== "pass") advice.push("namespaceControlPlaneBoundary failed -> remove Prometheus/Alertmanager from workload namespace; shared control plane belongs in devops-infra");
   if (summary.publicMetricsExposure !== "pass") advice.push("publicMetricsExposure failed -> public /metrics returned Prometheus text; remove FRP/edge exposure or add an authenticated internal-only route");
   return advice;
@@ -5697,6 +5698,7 @@ function runG14ObservabilityCloseout(options: G14ObservabilityOptions): Record<s
   const platformReady = record(status.crds).ok === true && record(status.operator).ok === true && record(status.prometheus).ok === true && record(status.query).ok === true;
   const namespaceBoundaryOk = record(record(boundary.namespaceBoundary)).ok === true && record(record(boundary.infraControlPlane)).ok === true;
   const publicDenied = record(record(boundary.publicMetricsExposure)).ok === true;
+  const resourceOk = record(record(targets.resourceSnapshot)).ok === true;
   const summary = {
     platformReady: passFail(platformReady),
     workloadMonitorCount: numericValue(record(status.workloadMonitors).count) ?? numericValue(record(targets.monitors).count) ?? 0,
@@ -5705,6 +5707,7 @@ function runG14ObservabilityCloseout(options: G14ObservabilityOptions): Record<s
     sidecarServing: passFail(queryOk("sidecarServing") && sidecarsOk),
     businessHealthProbe: passFail(queryOk("businessHealthProbe")),
     sidecarReady: passFail(sidecarsOk),
+    resourceSnapshot: passFail(resourceOk),
     namespaceControlPlaneBoundary: passFail(namespaceBoundaryOk),
     publicMetricsExposure: passFail(publicDenied),
     publicMetricsExposureState: publicDenied ? "denied" : "exposed-or-unknown",
@@ -5739,12 +5742,18 @@ function runG14ObservabilityCloseout(options: G14ObservabilityOptions): Record<s
         readySidecarCount: record(targets.sidecars).readyCount ?? null,
         healthProbeDuration: record(record(targets.levelSummary).healthProbeDuration),
         scrapeDuration: record(record(targets.levelSummary).scrapeDuration),
+        resourceSnapshot: record(targets.resourceSnapshot),
+        resourceUsage: record(record(targets.levelSummary).resourceUsage),
         services: arrayRecords(record(targets.levelSummary).services).map((service) => ({
           serviceId: service.serviceId ?? null,
           scrapeReachable: service.scrapeReachable ?? null,
           sidecarServing: service.sidecarServing ?? null,
           businessHealthProbe: service.businessHealthProbe ?? null,
           statusCode: service.statusCode ?? null,
+          totalCpuMillicores: service.totalCpuMillicores ?? null,
+          totalMemoryMiB: service.totalMemoryMiB ?? null,
+          businessCpuMillicores: service.businessCpuMillicores ?? null,
+          businessMemoryMiB: service.businessMemoryMiB ?? null,
         })),
       },
       boundary: {