fix: update playbooks read the backup VMID from the registry; drop client-side prune

The *-update.yml playbooks hard-coded the pre-migration VMIDs, so after cutover
the "safety backup" ran against the stopped OLD container. Now the VMID comes
from homelab_services['<svc>'].vmid.

Also removes `--prune-backups keep-all=1` from the vzdump calls: retention is
PBS's job (prune-pbs), and the client-side flag needed Datastore.Modify/Prune
the ansible@pve token does not have, which made vzdump print "Backup ... failed"
and exit non-zero after a successful upload.

gitea-update.yml additionally splits the offsite backup (hosts: gitea) from its
audit (hosts: cloud-pc), matching the profile move into the container.
pve-*.yml imports pass pve_provisioning_enabled: false so the runtime update
path never re-enters container creation.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V

ansible/playbooks/mihomo-update.yml

@@ -2,19 +2,23 @@
 - name: Verify Mihomo PBS audit before update
   hosts: mini-pc
   gather_facts: false
+  vars:
+    mihomo_vmid: "{{ homelab_services['mihomo'].vmid }}"
   tasks:
-    - name: Read VMID 143 configuration
-      ansible.builtin.command: "pct config 143"
+    - name: Read Mihomo VMID configuration
+      ansible.builtin.command: "pct config {{ mihomo_vmid }}"
       register: mihomo_pct_config
       changed_when: false
       failed_when: false
 
-    - name: Refuse to run backup unless VMID 143 is Mihomo
+    - name: Refuse to run backup unless registry VMID is Mihomo
       ansible.builtin.assert:
         that:
           - mihomo_pct_config.rc == 0
           - mihomo_update_hostname == 'mihomo'
-        fail_msg: VMID 143 must be the Mihomo container before backup.
+        fail_msg: >-
+          VMID {{ mihomo_vmid }} from the service registry must be the Mihomo
+          container before backup.
       vars:
         mihomo_update_hostname: >-
           {{ mihomo_pct_config.stdout_lines
@@ -41,13 +45,11 @@
       ansible.builtin.command:
         argv:
           - vzdump
-          - "143"
+          - "{{ mihomo_vmid }}"
           - --storage
           - pbs
           - --mode
           - snapshot
-          - --prune-backups
-          - keep-all=1
           - --exclude-path
           - /var/lib/docker/fuse-overlayfs/*/merged