fix(ops): route container pressure alerts to controller

docs/operations/host-cpu-pressure-drain-readback-2026-07-01.snapshot.json

@@ -92,6 +92,11 @@
       "change": "add Host110SustainedModeratePressure and point sustained-load auto_repair_action to the deployed /home/wooo/scripts controller path",
       "evidence": "Prometheus rule readback shows Host110SustainedModeratePressure loaded; after quota apply it is inactive because load5/core and Gitea CPU are below threshold"
     },
+    {
+      "path": "scripts/ops/host-sustained-load-controller.py",
+      "change": "route Gitea / StockPlatform container CPU quota pressure to source-specific playbook packets even when host load is below the critical load5/core threshold",
+      "evidence": "live controller readback after Gitea dropped below threshold returns observing; test fixture with Gitea 2.08 cores returns blocked_gitea_queue_or_hook_backlog_requires_playbook"
+    },
     {
       "path": "scripts/ops/backup-alert-label-contract-check.py",
       "change": "make BackupAggregateRunFailed ignore aggregate-only backup_all noise and require component job failed-count evidence",
@@ -140,6 +145,8 @@
           "gitea_container_cpu_cores_before_quota": "2.1856",
           "gitea_container_cpu_cores_after_quota_textfile": "1.4917",
           "gitea_container_cpu_limit_cores": "2",
+          "controller_container_cpu_threshold": "2.0",
+          "controller_latest_classification": "observing_load_within_threshold",
           "ssh_control_path": "available",
           "alert_rules": "Host110SustainedModeratePressure loaded; DockerContainerCpuSustainedHigh inactive; BackupAggregateRunFailed inactive",
           "alert_chain": "110 to VIP/120/121 /api/v1/webhooks/alertmanager synthetic no-secret smoke returned HTTP 200",