Task & service resources: `resources: {cpus, memory}` (enforcement-only)

[no0dles]

What to build

Let tasks and services declare an optional resources block (cpus, memory), enforced on both container runtimes. Enforcement-only for this release. On Docker, translate to host-config CPU (NanoCpus) and memory limits; on Kubernetes, translate to container resources.requests and resources.limits (request set equal to limit — no split requests/limits form for now). Units follow Kubernetes conventions: CPU as cores or millicores (2, 500m), memory as Mi/Gi. A local (non-container) task with resources must not fail — enforcement is best-effort/none and the value serves only as a scheduling hint (dry-run/explain should note non-enforcement). Invalid values (unparseable units, requests > limits) are rejected at validation time. cpus over host/cluster capacity → warn-and-run, never clamp (on k8s an over-capacity request leaves the pod Pending — k8s's own behavior, surfaced by the existing running-state wait). No resources declared → byte-identical behavior to today (additive). Resources do not participate in cache identity (ADR-0002).

Out of scope: Layer-2 resource-aware local scheduling (CPU-budget admission) is deferred — --concurrency is unchanged. Do not implement it in this slice.

References: specs/task-resources/spec.md (US1, US2, FR-001–005, 007, 008; US3/FR-006 explicitly deferred); docs/adr/0002.

Acceptance criteria

• A Docker task with resources produces a container whose CPU (NanoCpus) and memory limits match the declaration (SC-001).
• A k8s task/service with resources produces a container spec with matching requests/limits (request = limit) (SC-002).
• The same resources block applies to services on both runtimes (US2).
• Units follow k8s conventions (2/500m, Mi/Gi); invalid values and requests > limits are rejected at validation time.
• A local non-container task with resources does not fail; the value is treated as a hint only.
• cpus over capacity warns and runs (no clamp).
• Resources do not enter cache identity (the task id is unchanged by setting them).
• Layer-2 resource-aware scheduling is NOT implemented; --concurrency behavior is unchanged.
• A build file with no resources behaves identically to the prior version (SC-004).

Blocked by

• None - can start immediately.