rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
  all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
  from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
  os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions

.project-wiki/STATUS.md

@@ -0,0 +1,43 @@
+# Project Status
+
+Last updated: 2026-09-09
+
+## Scaffold State
+
+- Canonical scaffold created: yes
+- Project initialization complete: yes
+- Scan workflow: performed 2026-09-09 ([scan report](./implementation/scans/scan-20260909.md))
+- Technical documentation, requirements, traceability: populated
+
+## Current State
+
+- Repository fully scanned (root config, docker runtime, 3 inventories,
+  6 playbooks, 7 roles). Findings and module docs confirmed against source.
+- Open alerts: 0 (2 resolved on 2026-09-09) - see
+  [alerts/INDEX.md](./alerts/INDEX.md).
+- Open questions: 2 open / 2 partially-resolved / 2 resolved - see
+  [open-questions.md](./requirements/open-questions.md).
+
+## Next Documentation Steps
+
+- Confirm OQ-004 (external Zabbix passive server) and OQ-005 (Docker
+  template name) with the Zabbix server.
+- Fill `requirements/product-brief.md` and `GLOSSARY.md` when product-intent
+  sources allow, or remove them as placeholders.
+
+## Active Alerts
+
+- None. ALERT-20260909-001 (high) and ALERT-20260909-002 (medium) were
+  resolved on 2026-09-09: `admin_password` moved to encrypted `vault.yml`
+  (loaded via `vars_files` in `bootstrap.yml`), documentation updated to the
+  `cloudlorean` inventory, and the rename/change set committed coherently.
+
+## Blockers And Open Questions
+
+- OQ-004: external site Zabbix passive server points to the `healthcheck`
+  host's own IPv6 address - intentional or misconfiguration?
+- OQ-005: Docker Zabbix template name mismatch (`Docker by Zabbix agent2`
+  vs `Docker by Zabbix agent 2`).
+- OQ-001 / OQ-002: formal stakeholders and success criteria remain
+  undocumented (partially resolved: operators inferred as Niklas/Dennis;
+  update-run success defined by the healthcheck gate).