smoke: smol VMs by default + JOBS auto-detects nproc

Three quality-of-life improvements now that the daemon-side races
that gated parallel mode are fixed:

1. **Smol VMs by default.** Smoke installs a tuned config.toml at
   /etc/banger/config.toml between `system install` and `system
   restart` so the respawned daemon picks up:
       vcpu = 2
       memory_mib = 1024
       disk_size = "2G"
       system_overlay_size = "2G"
   Smoke scenarios assert behavior, not capacity — they don't need
   4 vCPU / 8 GiB / 8 GiB / 8 GiB. Per-VM RAM cost drops from 8 GiB
   to 1 GiB; nominal disk drops from 16 GiB to 4 GiB (sparse, so
   actual use is small either way, but the new ceiling is gentler
   on hosts that can't overcommit). Scenarios that test
   reconfiguration (vm_set's --vcpu 2 → 4) still pass --vcpu
   explicitly, so this default doesn't perturb their assertions.

2. **JOBS defaults to nproc.** The Makefile resolves JOBS to
   `$(shell nproc)` if unset; the smoke script's existing cap of 8
   keeps the parallel pool sane on bigger hosts. The script always
   passes --jobs N now, so behavior is consistent. Override with
   `make smoke JOBS=1` for a fully serial run.

3. **Help text catches up.** --help no longer flags parallelism as
   experimental (the underlying daemon races are fixed) and now
   describes the small-VM default. `make help` mentions the new
   default and how to override.

Verified: `make smoke` (no JOBS) on a 32-core box auto-runs with
JOBS=8, smol VMs, 21/21 PASS in 172s.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Makefile

@@ -61,7 +61,7 @@ help:
 	  '  make tidy            Run go mod tidy' \
 	  '  make clean           Remove built Go binaries and coverage artefacts' \
 	  '  make smoke           Build instrumented binaries, run the supported systemd smoke suite, report coverage (needs KVM + sudo)' \
-	  '  make smoke JOBS=N    Same, but dispatch parallel-safe scenarios across N slots (1-8; default 1)' \
+	  '  make smoke JOBS=N    Override parallelism (default: nproc, capped at 8 by the script). JOBS=1 forces serial.' \
 	  '  make smoke-list      Print the list of smoke scenarios with descriptions (no build, no install)' \
 	  '  make smoke-one SCENARIO=NAME  Run a single smoke scenario (still does the install preamble)' \
 	  '  make smoke-fresh     smoke-clean + smoke — purges stale smoke-owned installs before a clean supported-path run' \
@@ -176,13 +176,18 @@ $(SMOKE_BIN_DIR)/.built: $(BUILD_INPUTS) go.mod go.sum
 	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -ldflags '$(GO_LDFLAGS)' -o "$(SMOKE_BIN_DIR)/banger-vsock-agent" ./cmd/banger-vsock-agent
 	touch "$@"
 
+# JOBS defaults to nproc (the script caps at 8). Override with
+# `make smoke JOBS=1` for a fully serial run, or any specific N for
+# tighter parallelism.
+JOBS ?= $(shell nproc 2>/dev/null || echo 1)
+
 smoke: smoke-build
 	rm -rf "$(SMOKE_COVER_DIR)"
 	mkdir -p "$(SMOKE_COVER_DIR)" "$(SMOKE_XDG_DIR)"
 	BANGER_SMOKE_BIN_DIR="$(abspath $(SMOKE_BIN_DIR))" \
 	BANGER_SMOKE_COVER_DIR="$(abspath $(SMOKE_COVER_DIR))" \
 	BANGER_SMOKE_XDG_DIR="$(abspath $(SMOKE_XDG_DIR))" \
-	  bash "$(SMOKE_SCRIPT)" $(if $(JOBS),--jobs $(JOBS))
+	  bash "$(SMOKE_SCRIPT)" --jobs $(JOBS)
 	@echo ''
 	@echo 'Smoke coverage:'
 	@$(GO) tool covdata percent -i="$(SMOKE_COVER_DIR)"

scripts/smoke.sh

@@ -144,15 +144,12 @@ Usage:
 
 Notes:
   --list works on a fresh checkout — no sudo, no KVM, no smoke-build.
-  --jobs N caps at min(N, 8); each parallel slot runs an 8 GiB VM.
+  --jobs N caps at min(N, 8). Smoke-tuned VMs default to 1 GiB RAM /
+  2 GiB work disk, so 8 parallel slots fit comfortably on most hosts.
   Scenarios in the 'repodir' class share fixture mutations and run as
-  a serial chain regardless of --jobs.
-
-  Parallelism (--jobs >1) is experimental: it surfaces real concurrency
-  bugs in the daemon's image-pull and work-seed-refresh paths that don't
-  appear in serial mode. Use serial (--jobs 1, the default) for reliable
-  CI-style runs; use --jobs N when you can tolerate a few re-runs to
-  debug something fast.
+  a serial chain regardless of --jobs. Scenarios in 'global' (vm prune,
+  NAT, invalid-spec/name) run serially after the parallel pool because
+  they assert host-wide state.
 
 Exit codes: 0 ok, 1 fail, 2 usage error, 77 explicit selection skipped.
 EOF
@@ -364,6 +361,24 @@ install_preamble() {
     die 'doctor reported failures; fix the host before running smoke'
   fi
 
+  # Drop a smoke-tuned config in place before the restart so the
+  # respawned daemon picks up small VM defaults: 2 vCPU / 1 GiB RAM /
+  # 2 GiB work disk / 2 GiB system overlay. Smoke scenarios assert
+  # behaviour, not capacity — full-size 4-vCPU / 8 GiB / 8 GiB / 8 GiB
+  # VMs are pure overhead here, and the size matters once `--jobs`
+  # multiplies it across slots. `vm_set` overrides --vcpu explicitly,
+  # so its 2→4 reconfigure check is unaffected by this default.
+  log 'writing smoke-tuned daemon config'
+  sudo tee /etc/banger/config.toml >/dev/null <<'TOML' || die 'failed to write smoke config'
+# Smoke-tuned defaults — every VM starts small unless the scenario
+# overrides --vcpu / --memory / --disk-size explicitly.
+[vm_defaults]
+vcpu = 2
+memory_mib = 1024
+disk_size = "2G"
+system_overlay_size = "2G"
+TOML
+
   log 'system restart: services should come back cleanly'
   sudo_banger "$BANGER" system restart >/dev/null || die 'system restart failed'
   status_out="$("$BANGER" system status)" || die 'system status failed after restart'