rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
  all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
  from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
  os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions

.project-wiki/technical/deployment.md

@@ -0,0 +1,59 @@
+---
+id: TECH-DEPLOYMENT
+type: technical
+status: active
+title: Deployment (Runtime Environment)
+created: '2026-09-09'
+updated: '2026-09-09'
+tags:
+- technical
+- deployment
+- docker
+related:
+- TECH-ARCHITECTURE
+source_paths:
+- execute.sh
+- docker/Dockerfile
+- docker/requirements.yml
+- docker/ansible-functs.sh
+- ansible.cfg
+confidence: confirmed
+---
+
+# Deployment (Runtime Environment)
+
+## Docker Image
+
+- `docker/Dockerfile`: `debian:trixie-slim`, `TZ=Europe/Berlin`,
+  `ANSIBLE_VERSION=2.20.6` → `pip3 install ansible-core~=2.20.6`.
+- Utilities: nano, git, wget, unzip, curl, python3-pip, tzdata, openssh-client,
+  ping, vim, less.
+- Bakes SSH client policy: `StrictHostKeyChecking no`,
+  `UserKnownHostsFile /dev/null` (`/etc/ssh/ssh_config.d/99-no-hostkey-check.conf`).
+- Installs pinned collections from `docker/requirements.yml`:
+  `ansible.posix` 2.2.0, `community.general` 13.0.1, `community.docker`
+  5.2.0, `community.zabbix` 4.2.0.
+- Copies `ansible-functs.sh` into `/root/.bashrc.d/` providing aliases
+  `ap` (ansible-playbook), `ag` (ansible-galaxy), `av` (ansible-vault).
+
+## Launch Flow (execute.sh)
+
+1. Pick next free container name `ansible-<n>`.
+2. Ensure IPv6-enabled bridge network `ansible-dualstack` (fails fast with
+   a clear message if the network exists without IPv6).
+3. Run the container detached: repo mounted at `/ansible` (workdir), SSH
+   keys from the `ansible_ssh_keys` volume into `/root/.ssh`, env
+   `ANSIBLE_HOST_KEY_CHECKING=False`, `ANSIBLE_CONFIG=./ansible.cfg`.
+4. Write a per-container SSH client config, print name/IPv4/IPv6/OS, then
+   `docker attach` for interactive use.
+
+## Controller-Side Artifacts
+
+- `.zabbix-psk/` and `logs/` are written by delegation from the container
+  into the mounted repo (git-ignored).
+
+## Operational Notes
+
+- Changing collections requires updating `docker/requirements.yml` and an
+  image rebuild (AGENTS.md).
+- Default image tag: `ansible:deb13`.