Sync the self-hosting stack

CHANGELOG.md

@@ -9,6 +9,16 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-10-26 — The script library can run, still hidden `api 2.1.6` `web 2.1.10`
+
+**Nothing changes on screen.** The script library gains what runs a script on many machines and shows
+each machine's result, and like the rest of it, it stays hidden until it is finished. The published
+configuration gains two limits on how many script jobs run at once, `SCRIPT_MAX_RUNNING_JOBS` (200
+for the platform) and `SCRIPT_MAX_RUNNING_JOBS_PER_ORG` (50 per organization); they have no effect
+while the library is hidden. The database does not change.
+
+Update the web image first, or both images at once. No agent update is required.
+
 ## 2026-10-25 — Groundwork for the script library `api 2.1.5` `web 2.1.9`
 
 **Nothing changes on screen.** These builds carry the first part of the script library — scripts

kubernetes/02-config.yaml

@@ -74,6 +74,10 @@ data:
   # every route it adds answers 404 until its milestone ships. "true" shows the unfinished area; it is
   # for the team's own dev stack, never a customer platform.
   SCRIPTS_PREVIEW: "false"
+  # How many script jobs may run on machines at once, platform-wide and per organization. "0" stops
+  # dispatching new ones; it cancels nothing.
+  SCRIPT_MAX_RUNNING_JOBS: "200"
+  SCRIPT_MAX_RUNNING_JOBS_PER_ORG: "50"
 
   # The browser service — a separate pod on purpose, see 09-browser.yaml. COMMENTED OUT to match
   # that file: with no browser deployed, setting this only turns "unavailable" into a timeout.