rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
  all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
  from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
  os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions

roles/os-updates/tasks/logging_postflight.yml

@@ -38,9 +38,10 @@
       reboot_required: {{ os_update_reboot_required }}
       reboot_reason: {{ os_update_reboot_reason }}
       reboot_triggered: {{ os_update_reboot_triggered }}
+      reboot_deferred: {{ os_update_reboot_deferred }}
       reboot_started: {{ os_update_reboot_start_iso }}
       reboot_downtime_seconds: {{ os_update_reboot_downtime_seconds }}
       kernel_before: {{ os_update_running_kernel.stdout | default('n/a') }}
       kernel_after: {{ os_update_running_kernel_after }}
   delegate_to: localhost
-  when: os_update_logging_enabled | bool
+  when: os_update_logging_enabled | bool

roles/os-updates/tasks/reboot.yml

@@ -34,10 +34,27 @@
 - name: Default reboot timing facts
   set_fact:
     os_update_reboot_triggered: false
+    os_update_reboot_deferred: false
     os_update_reboot_start_iso: "n/a"
     os_update_reboot_downtime_seconds: 0
     os_update_running_kernel_after: "{{ os_update_running_kernel.stdout | default('n/a') }}"
 
+- name: Notify when reboot is deferred on Proxmox
+  ansible.builtin.debug:
+    msg: "Reboot required but deferred on Proxmox host {{ ansible_facts['hostname'] }}: {{ os_update_reboot_reason }}"
+  when:
+    - os_update_reboot_required | bool
+    - "'proxmox' in group_names"
+    - not os_update_reboot_on_proxmox | bool
+
+- name: Record deferred reboot on Proxmox
+  ansible.builtin.set_fact:
+    os_update_reboot_deferred: true
+  when:
+    - os_update_reboot_required | bool
+    - "'proxmox' in group_names"
+    - not os_update_reboot_on_proxmox | bool
+
 - block:
     - name: Reboot - Record start time
       command: date -Iseconds
@@ -80,4 +97,6 @@
         os_update_reboot_triggered: true
         os_update_reboot_start_iso: "{{ os_update_reboot_start_iso_raw.stdout }}"
         os_update_running_kernel_after: "{{ os_update_running_kernel_after_raw.stdout }}"
-  when: os_update_reboot_required | bool
+  when:
+    - os_update_reboot_required | bool
+    - "'proxmox' not in group_names or os_update_reboot_on_proxmox | bool"

roles/os-updates/tasks/upgrade_packages.yml

@@ -5,6 +5,7 @@
   apt:
     upgrade: full
     update_cache: yes
+    install_recommends: true
   register: os_update_upgrade_result
   notify:
     - apt cleanup