[88plug]

Follows #250 (eat-up.sh deploys EAT release-1.1.0), now merged into main; this PR targets main. It fills the remaining part of gap G01 from the agent-stack gap matrix.

#250 closes G01's main gap, because eat-up.sh now deploys release-1.1.0 (integrations/eat/eat-up.sh:30-31). It also closes G03, because vLLM CPU v0.28.0 is pinned by digest (integrations/eat/vllm-values.yaml:23, images.lock), and tests/eat_test.sh section 7 fails if the EAT tag and the vLLM tag drift apart. What #250 leaves open is that no eat-up.sh config should be able to add a second balloons policy or a second GPU plugin. Today a user config can do both, because only the shipped agentic-config.cfg writes those keys off.

What changes

eat-up.sh now stops before it touches the cluster in the cases below. Each key is read the way release-1.1.0's read_config_file reads it: trimmed, unquoted, with the last assignment winning. Line numbers refer to 0c726f5 and were checked there with gh api.

Setting	Why it collides on a k3d-gpu cluster
deploy_nri_balloon_policy set to anything but off or no, including an absent key	fresh-install.sh:247 deploys EAT's balloons policy on yes, beside k3d-gpu's. prompt_for_input turns an absent key on for compute_platform c (parse-user-prompts.sh:55-66). The stack path calls it (fresh-install.sh:39), so an absent key deploys EAT's policy there; in brownfield.sh model mode it makes deploy-inference-models.yml set vLLM's balloon to vllm-balloon-tp<N> over k3d-gpu's performance.
compute_platform=x or xpu	fresh-install.sh:219 applies intel-device-plugins' gpu_plugin from main, unpinned (deploy-intel-gpu-plugin.yml:12-14), beside the plugin k3d-gpu bakes. The message points at K3D_GPU_AGENT_BACKEND=vllm k3d-gpu agent up.
deploy_kata_containers=on	Kata needs /dev/kvm (deploy-kata-containers.yml), and a k3d node is a container without it.
rack_scale_mode=on	It builds its own cluster from rack-profile.yaml: netplan, BGP and the NVIDIA GPU operator (fresh-install.sh:195-210).

The shipped agentic-config.cfg already writes each of these off, so the default path and F4's run are unchanged. integrations/eat/README.md (blockers 10 and 12) and the XPU notes in docs/platforms.md describe the refusals.

Tests (written first)

The first commit holds the tests alone, and at that commit 14 cases fail with kubeconfig /nonexistent not found. They are in tests/eat_test.sh section 3d. Each case covers one key with these spellings:

• absent, on, yes, empty
• last assignment wins
• off, no, spaces and quotes
• for compute_platform: xpu, x, quoted, cpu, absent

One more case checks that the xpu refusal names the vLLM alternative, and another that the balloons refusal says EAT deploys its policy when the key is on or absent.

tests/eat_test.sh             106 passed, 0 failed
tests/platforms_doc_test.sh   195 passed, 0 failed
tests/ci_wiring_test.sh        69 passed, 0 failed
tests/bench_test.sh            71 passed, 0 failed
tests/image_pins_test.sh       43 passed, 0 failed
tests/claims_check_test.sh     81 passed, 0 failed
tests/claims_check.sh          claims_check: 26 file(s) clean
python3 tests/ledger_drift_check_test.py   OK
python3 tests/ledger_drift_check.py        41 file(s) agree with 81 ledger rows
tests/pe_premise_check_test.sh  16 passed, 0 failed
tests/pe_premise_check.sh       ok
tests/docs_test.sh              63 passed, 0 failed; mkdocs build --strict rc 0 (docs-build/requirements.txt, --require-hashes)
shellcheck v0.11.0 --severity=warning: eat-up.sh, tests/eat_test.sh clean

Not verified

Nothing here has run against a live 1.1.0 stack, and F4 is still pending. These refusals come from reading EAT's source at 0c726f5, not from a run.