Review: Bump agent parallel workflows 1 to 4

Verdict: READY

Template Completeness

• [x] Type — Feature
• [x] Lineage — discovered during incident #184
• [x] Repo — forgejo_admin/pal-e-platform
• [x] User Story — platform operator wants concurrent CI
• [x] Context — resource headroom analysis included
• [x] File Targets — terraform/main.tf agent env block
• [x] Acceptance Criteria — 4 items, all verifiable
• [x] Test Expectations — tofu validate, tofu plan, concurrent pipeline test
• [x] Constraints — lock=false, start at 4, monitor post-deploy
• [x] Checklist — standard PR/tests/no-unrelated
• [x] Related — links #184, #191, project-pal-e-platform

Traceability

• [x] story:superuser-deploy — superuser deploy story
• [x] arch:ci-pipeline — CI pipeline architecture component
• [x] Forgejo issue — forgejo_admin/pal-e-platform#194, open

File Targets

• [x] terraform/main.tf line ~779 — verified: agent env block at lines 779-787, contains WOODPECKER_BACKEND, WOODPECKER_FILTER_LABELS, etc. No MAX_WORKFLOWS present currently. Adding the env var here is the correct location.
• [x] "Files NOT to touch" section — correctly identifies agent resource limits and replicaCount as out of scope

Repo Placement

Dependencies

• #191 (agent label routing) — in_progress, touches same Helm values block (agent env). Not a blocker since they modify different env vars, but agent should rebase if #191 merges first.
• #184 (Harbor connectivity incident) — in_progress, parent incident that surfaced this discovered scope. Not a blocker.
• #193 (Kaniko insecure-registry) — in_progress, also modifying CI pipeline config. Independent change, no conflict.

Acceptance Criteria

• WOODPECKER_MAX_WORKFLOWS=4 in agent Helm values — grep-checkable after edit
• tofu plan shows only agent env change — runnable command with parseable output
• Concurrent pipeline test — requires post-deploy validation (manual or triggered via Woodpecker MCP)
• No OOM/throttling — requires post-deploy monitoring (manual check)

Blast Radius

Recommendation