rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
  all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
  from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
  os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions

roles/monitoring/tasks/configure-psk.yml

@@ -12,6 +12,13 @@
   become: false
   run_once: false
 
+- name: Show PSK store path
+  ansible.builtin.debug:
+    msg: "Persisting PSKs on the controller in {{ monitoring_zabbix_psk_store }}"
+  delegate_to: localhost
+  become: false
+  changed_when: false
+
 - name: Check whether PSK already exists on controller
   ansible.builtin.stat:
     path: "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
@@ -37,6 +44,17 @@
                 monitoring_zabbix_psk_store ~ '/' ~ inventory_hostname ~ '.psk')
          | trim }}
 
+- name: Validate PSK format
+  ansible.builtin.assert:
+    that:
+      - monitoring_zabbix_psk_value is match('^[0-9a-fA-F]+$')
+      - monitoring_zabbix_psk_value | length == (monitoring_zabbix_psk_bits / 4) | int
+    fail_msg: >-
+      The PSK must contain exactly {{ (monitoring_zabbix_psk_bits / 4) | int }}
+      hexadecimal characters.
+  delegate_to: localhost
+  become: false
+
 - name: Ensure Zabbix agent runtime directory exists
   ansible.builtin.file:
     path: "{{ monitoring_zabbix_psk_file | dirname | default('/etc/zabbix') }}"
@@ -52,4 +70,4 @@
     owner: "{{ monitoring_zabbix_agent_user }}"
     group: "{{ monitoring_zabbix_agent_user }}"
     mode: '0600'
-  notify: Restart Zabbix Agent
+  notify: Restart Zabbix Agent