chore: 실행 환경 구성 문서 추가 및 수정

deploy/lab/cloud-init/kc-lab.yaml.example

@@ -17,7 +17,12 @@ users:
     shell: /bin/bash
     # NOPASSWD is required: the k3s installer and the fault-injection scripts
     # run non-interactively and would block on a password prompt.
-    sudo: ['ALL=(ALL) NOPASSWD:ALL']
+    #
+    # A string, not a list. The list form still boots, but `cloud-init schema -c`
+    # (22.4.2 on the guests) rejects it and prints the whole users.0 block with
+    # "is not valid under any of the given schemas" — naming no key. That makes
+    # the guide's own validation step look broken when it is not.
+    sudo: "ALL=(ALL) NOPASSWD:ALL"
     # Console-only escape hatch. Without it, a cloud-init failure leaves a guest
     # that cannot be logged into at all, so its own failure log is unreadable.
     # ssh_pwauth stays false, so this never widens SSH exposure.
@@ -35,3 +40,9 @@ package_update: true
 packages:
   - curl
   - nftables
+# kc-lab-edge only. The k3s nodes do not need these, and the edge does not need
+# anything else — nginx terminates TLS and certbot renews the certificate, both
+# inside this disposable guest.
+#  - nginx
+#  - certbot
+#  - python3-certbot-dns-cloudflare