rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
  all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
  from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
  os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions

.project-wiki/technical/testing.md

@@ -0,0 +1,41 @@
+---
+id: TECH-TESTING
+type: technical
+status: active
+title: Testing
+created: '2026-09-09'
+updated: 2026-09-09
+tags:
+- technical
+- testing
+related:
+- MOD-005
+source_paths: []
+confidence: confirmed
+---
+
+# Testing
+
+## Automated Tests
+
+- None found. The repository has no test suite, no CI configuration, and no
+  lint config (`confidence: confirmed` for absence in the working tree).
+
+## Verification Approach (documented in AGENTS.md / README)
+
+1. Run changes in the Docker container: `./execute.sh` (image
+   `ansible:deb13`, repo mounted at `/ansible`).
+2. Optional lint: `ansible-lint` (recommended by AGENTS.md, not installed in
+   the image by default).
+3. Dry runs with `ansible-playbook --check` where sensible.
+4. Role-level documentation duty: update the role README with every
+   variable/task/template change.
+
+## Built-In Quality Gates
+
+- Playbook-level Debian guard (`os_family` check) on all playbooks except
+  `playbooks/hardening/manage-ssh-keys.yml`.
+- `healthcheck` role: post-update container quality gate, optionally failing
+  the play (`healthcheck_fail_on_unhealthy`, default false).
+- `monitoring` role: PSK format/length assertion, role input validation task
+  (`validate.yml`).