fix: update playbooks read the backup VMID from the registry; drop client-side prune

The *-update.yml playbooks hard-coded the pre-migration VMIDs, so after cutover
the "safety backup" ran against the stopped OLD container. Now the VMID comes
from homelab_services['<svc>'].vmid.

Also removes `--prune-backups keep-all=1` from the vzdump calls: retention is
PBS's job (prune-pbs), and the client-side flag needed Datastore.Modify/Prune
the ansible@pve token does not have, which made vzdump print "Backup ... failed"
and exit non-zero after a successful upload.

gitea-update.yml additionally splits the offsite backup (hosts: gitea) from its
audit (hosts: cloud-pc), matching the profile move into the container.
pve-*.yml imports pass pve_provisioning_enabled: false so the runtime update
path never re-enters container creation.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V

ansible/playbooks/grimmory-update.yml

@@ -24,23 +24,26 @@
 - name: Create a fresh Grimmory PBS backup
   hosts: cloud-pc
   gather_facts: false
+  vars:
+    grimmory_vmid: "{{ homelab_services['grimmory'].vmid }}"
   tasks:
     - name: Read Grimmory LXC config
       ansible.builtin.command:
         argv:
           - pct
           - config
-          - "149"
+          - "{{ grimmory_vmid }}"
       register: grimmory_pct_config
       changed_when: false
 
-    - name: Assert VMID 149 belongs to Grimmory
+    - name: Assert registry VMID belongs to Grimmory
       ansible.builtin.assert:
         that:
           - grimmory_pct_hostname_line != ""
           - grimmory_pct_hostname == "grimmory"
         fail_msg: >-
-          Refusing to run vzdump 149 because pct config hostname is not grimmory:
+          Refusing to run vzdump {{ grimmory_vmid }} because pct config
+          hostname is not grimmory:
           {{ grimmory_pct_hostname_line | default('missing hostname line') }}
       vars:
         grimmory_pct_hostname_line: >-
@@ -66,13 +69,11 @@
       ansible.builtin.command:
         argv:
           - vzdump
-          - "149"
+          - "{{ grimmory_vmid }}"
           - --storage
           - pbs
           - --mode
           - snapshot
-          - --prune-backups
-          - keep-all=1
           - --exclude-path
           - /var/lib/docker/fuse-overlayfs/*/merged
 
@@ -90,6 +91,8 @@
       changed_when: true
 
 - import_playbook: pve-grimmory.yml
+  vars:
+    pve_provisioning_enabled: false
 
 - name: Verify Grimmory public endpoint after update
   hosts: ru-vps