simpler check and deps messages

rig/docs/notes/kind-config.md

@@ -0,0 +1,23 @@
+# ctrl/k8s/kind-config.yaml.tpl
+
+## Why a template
+
+The cluster: one node by default — add nodes or port mappings by editing the file, then `make cluster reset`.
+
+It is a TEMPLATE rather than a plain kind-config.yaml because a rig is copied and renamed to make a second environment, and both the cluster name and the host port follow the directory. A checked-in literal would make every copy collide on both. ctrl/cluster.sh renders it with sed — not envsubst, which is gettext-base and absent from a minimal Debian, and rig's whole premise is that Docker is the only prerequisite.
+
+## Substituted variables
+
+Substituted by ctrl/cluster.sh: CLUSTER, NODE_IMAGE, HTTP_PORT, HOST_WORKDIR. The header comment names them without the `${...}` braces so that line survives the substitution.
+
+## Node count
+
+The node count is READ BACK from this file by lib/config.sh, so this YAML is the source of truth for it — there is no second place to update.
+
+## containerdConfigPatches
+
+Point containerd at a certs.d directory. registry.sh drops per-host hosts.toml files in there afterwards, so switching registry mode never requires recreating the cluster.
+
+## extraPortMappings
+
+One NodePort bridged to the host; an in-cluster gateway owns it. There is deliberately no ingress controller — they pin a narrow window of k8s versions, and running a trailing-edge control plane is the point.