Use a larger fapolicyd subject cache in deployment tests #880

The fapolicyd proxy job can still evict /usr/bin/bash from the subject cache after the Forklift default was increased to 16381 in theforeman/forklift#1990.

In run 36239704648, job 108397783415, the diagnostic archive confirms that /etc/fapolicyd/fapolicyd.conf contains subj_cache_size = 16381. At the failure, fapolicyd-cli --check-status reported 4222 slots in use (25%) and one early eviction, while the journal said:

/usr/bin/bash is being evicted from the subject cache before pattern detection completes: increase subj_cache_size

bash was then denied with EPERM and the deployment test collapsed. This is a hash/PID collision under the test's high process churn, not a full cache.

Upstream tuning guidance recommends prime-sized caches to reduce collisions and lists 65353 as the largest suggested value below the 64k process ceiling.

Override fapolicyd_subj_cache_size to 65353 in the development security playbook instead of increasing the Forklift role default globally. That keeps the extra memory limited to this high-churn test workload, which is important because the same VM also hit OOM.