[wax911]

Refs #656

What changed

• Add a strict, versioned Pulumi inventory adapter for lab VMs and HCloud, including safe storage paths and create-only formatting policy.
• Add Ubuntu 24.04 host baseline, stable-ID storage, Tailscale and host-firewall roles, with separate bootstrap, fresh-host, upgrade, reconnect and verification playbooks.
• Add a fail-closed runner, pinned toolchain, CI lint and a real Docker-backed Molecule scenario covering convergence, zero-change idempotence, stale-key and baseline drift repair, verification and owned-container cleanup.
• Add full VM storage, SSH recovery, firewall, reboot and post-reboot verification scenarios. Update validation and operator documentation.

Verification

• PLATFORM_DOCKER_CONTEXT=default PLATFORM_ALLOWED_DOCKER_CONTEXTS=default make platform-ansible-test ENV=lab: pass on local Linux x86_64 Docker with Swarm inactive. Python 3.14.9, ansible-core 2.21.5, Molecule 26.10.0, molecule-plugins 26.10.12; collections ansible.posix 2.2.2, community.docker 5.0.0, community.general 13.5.0 and community.library_inventory_filtering_v1 1.1.5. The Ubuntu 24.04 fixture uses ubuntu@sha256:68ee22004a9109b44973313b02ff7b1de250f1de0f5ecb628d73f579aaff33ac. Molecule reports 1 scenario successful, including stale-key removal and zero-change second convergence. The stale-key regression failed at the exact-key assertion before exclusive: true was added, then passed.
• make platform-pulumi-test ENV=lab: 2 Docker-provider mock tests, 16 HCloud tests and 64 platform Python tests passed.
• PATH=/tmp/omp-platform-lab-654-testenv/bin:$PATH bash tools/ci/test-risk-review-scripts.sh: 19/19 passed.
• PATH=/tmp/omp-platform-lab-654-testenv/bin:$PATH yamllint -d '{extends: default, rules: {line-length: {max: 120}}}' ansible/: passed.
• python -m py_compile tools/platform/ansible_runner.py tools/platform/ansible_inventory.py tools/platform/host_firewall.py: passed in the pinned Python 3.14.9 environment.
• python3 -c 'import yaml; yaml.safe_load(open(".github/workflows/ci.yml", encoding="utf-8"))': passed.
• git diff --cached --check: passed.
• make platform-host-verify ENV=lab TIER=vm correctly blocked before connecting because the inventory, signed host-trust bundle/root, SSH keys and Tailscale credentials/tag were not supplied. No VM acceptance is claimed.

Safety and remaining gates

• This PR is stacked on feat/platform-hcloud-655 (PR feat(platform): add protected HCloud provisioning and preview #670 head); feat(platform): add protected HCloud provisioning and preview #670 itself is stacked on feat/platform-lab-654 (PR feat(platform): phase 1 add an isolated Docker lab and validation contract #669 head). Retarget after predecessor merges.
• No HCloud preview/apply or real-host mutation was run. HCloud apply remains blocked until G0 defines and authorizes outbound destinations.
• This PR remains draft pending full VM acceptance and predecessor gates. It does not close feat(ansible): phase 1 add an idempotent host baseline with container and VM tests #656.