rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
  all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
  from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
  os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions

roles/os-updates/tasks/reboot.yml

@@ -34,10 +34,27 @@
 - name: Default reboot timing facts
   set_fact:
     os_update_reboot_triggered: false
+    os_update_reboot_deferred: false
     os_update_reboot_start_iso: "n/a"
     os_update_reboot_downtime_seconds: 0
     os_update_running_kernel_after: "{{ os_update_running_kernel.stdout | default('n/a') }}"
 
+- name: Notify when reboot is deferred on Proxmox
+  ansible.builtin.debug:
+    msg: "Reboot required but deferred on Proxmox host {{ ansible_facts['hostname'] }}: {{ os_update_reboot_reason }}"
+  when:
+    - os_update_reboot_required | bool
+    - "'proxmox' in group_names"
+    - not os_update_reboot_on_proxmox | bool
+
+- name: Record deferred reboot on Proxmox
+  ansible.builtin.set_fact:
+    os_update_reboot_deferred: true
+  when:
+    - os_update_reboot_required | bool
+    - "'proxmox' in group_names"
+    - not os_update_reboot_on_proxmox | bool
+
 - block:
     - name: Reboot - Record start time
       command: date -Iseconds
@@ -80,4 +97,6 @@
         os_update_reboot_triggered: true
         os_update_reboot_start_iso: "{{ os_update_reboot_start_iso_raw.stdout }}"
         os_update_running_kernel_after: "{{ os_update_running_kernel_after_raw.stdout }}"
-  when: os_update_reboot_required | bool
+  when:
+    - os_update_reboot_required | bool
+    - "'proxmox' not in group_names or os_update_reboot_on_proxmox | bool"