fix: gate the remaining migrated creation plays behind provisioner != tofu

pve-emergency-bot.yml, pve-monitoring.yml and pve-docker-test.yml still ran
their creation plays unconditionally. Invoking make deploy-<svc> would pct
start / pct reboot the stopped OLD VMID (148/146/145) on its production IP,
colliding with the live tofu-managed container.

Add the same pre_tasks `meta: end_play` guard the other seven migrated services
already carry: skip while homelab_services['<svc>'].provisioner == 'tofu',
override with -e pve_<svc>_legacy_provisioning_enabled=true for an intentional
legacy rollback. Verified with --check: both plays in each file end immediately,
no pct calls.

Config for these three lives elsewhere (emergency-access.yml, uptime-kuma.yml,
pve-docker-test.yml play 2), so gating the creation plays makes the files
full no-ops under tofu, like pve-gyro.yml.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V

ansible/playbooks/pve-docker-test.yml

@@ -3,6 +3,13 @@
   hosts: cloud-pc
   gather_facts: false
   vars:
+    # После переезда на OpenTofu (tofu/svc-docker-test.tf, VMID 152) этот play —
+    # legacy: он таргетит СТАРЫЙ VMID 145 и его handler/"Start" сделали бы
+    # pct start 145, подняв остановленный откат на боевом адресе 192.168.1.29.
+    # Пропускаем, пока реестр говорит provisioner: tofu. Для намеренного
+    # legacy rollback: -e pve_docker_test_legacy_provisioning_enabled=true
+    pve_docker_test_legacy_provisioning_enabled: >-
+      {{ homelab_services['docker-test'].provisioner != 'tofu' }}
     docker_test_vmid: 145
     docker_test_hostname: docker-test
     docker_test_ip: 192.168.1.29/24
@@ -14,6 +21,10 @@
     - name: restart docker test lxc
       ansible.builtin.shell: "pct stop {{ docker_test_vmid }} || true; pct start {{ docker_test_vmid }}"
       changed_when: true
+  pre_tasks:
+    - name: Skip legacy docker-test provisioning after cutover
+      ansible.builtin.meta: end_play
+      when: not (pve_docker_test_legacy_provisioning_enabled | bool)
   tasks:
     - name: Check if Docker test LXC exists
       ansible.builtin.command: "pct config {{ docker_test_vmid }}"

ansible/playbooks/pve-emergency-bot.yml

@@ -1,4 +1,10 @@
 ---
+# После переезда на OpenTofu (tofu/services.tf, VMID 151) обе play здесь —
+# legacy: они таргетят СТАРЫЙ VMID 148 на боевом адресе 192.168.1.32.
+# Пропускаем, пока реестр говорит provisioner: tofu. Конфигурация emergency-bot
+# в этот плейбук не входит — она в playbooks/emergency-access.yml. Для
+# намеренного legacy rollback: -e pve_emergency_bot_legacy_provisioning_enabled=true
+
 - name: Create emergency-bot LXC on mini-pc
   hosts: localhost
   connection: local
@@ -7,6 +13,8 @@
   vars:
     ansible_become: false
     ansible_python_interpreter: "{{ ansible_playbook_python }}"
+    pve_emergency_bot_legacy_provisioning_enabled: >-
+      {{ homelab_services['emergency-bot'].provisioner != 'tofu' }}
     pve_lxc_vmid: 148
     pve_lxc_node: mini-pc
     pve_lxc_hostname: emergency-bot
@@ -18,12 +26,23 @@
     pve_lxc_swap: 256
     pve_lxc_startup: order=70
     pve_lxc_ostemplate: "{{ lookup('env', 'PVE_LXC_OSTEMPLATE') | default('local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst', true) }}"
+  pre_tasks:
+    - name: Skip legacy emergency-bot provisioning after cutover
+      ansible.builtin.meta: end_play
+      when: not (pve_emergency_bot_legacy_provisioning_enabled | bool)
   roles:
     - role: pve_lxc
 
 - name: Wait for emergency-bot SSH
   hosts: emergency-bot
   gather_facts: false
+  vars:
+    pve_emergency_bot_legacy_provisioning_enabled: >-
+      {{ homelab_services['emergency-bot'].provisioner != 'tofu' }}
+  pre_tasks:
+    - name: Skip legacy emergency-bot provisioning after cutover
+      ansible.builtin.meta: end_play
+      when: not (pve_emergency_bot_legacy_provisioning_enabled | bool)
   tasks:
     - name: Wait for emergency-bot to accept SSH connections
       ansible.builtin.wait_for_connection:

ansible/playbooks/pve-monitoring.yml

@@ -1,4 +1,12 @@
 ---
+# После переезда на OpenTofu (tofu/svc-monitoring.tf, VMID 155) обе play здесь —
+# legacy: они таргетят СТАРЫЙ VMID 146 на боевом адресе 192.168.1.30, а вторая
+# делает pct reboot 146. Пропускаем, пока реестр говорит provisioner: tofu.
+# Конфигурация (Uptime Kuma) в этот плейбук не входит — она в
+# playbooks/uptime-kuma.yml. Замороженный Prometheus-стек в новый контейнер не
+# разворачивался. Для намеренного legacy rollback:
+#   -e pve_monitoring_legacy_provisioning_enabled=true
+
 - name: Create monitoring LXC on cloud-pc
   hosts: localhost
   connection: local
@@ -7,6 +15,8 @@
   vars:
     ansible_become: false
     ansible_python_interpreter: "{{ ansible_playbook_python }}"
+    pve_monitoring_legacy_provisioning_enabled: >-
+      {{ homelab_services['monitoring'].provisioner != 'tofu' }}
     pve_lxc_vmid: 146
     pve_lxc_node: cloud-pc
     pve_lxc_hostname: monitoring
@@ -20,12 +30,23 @@
     pve_lxc_features:
       - nesting=1
     pve_lxc_ostemplate: local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst
+  pre_tasks:
+    - name: Skip legacy monitoring provisioning after cutover
+      ansible.builtin.meta: end_play
+      when: not (pve_monitoring_legacy_provisioning_enabled | bool)
   roles:
     - role: pve_lxc
 
 - name: Enable Docker keyctl feature for monitoring LXC
   hosts: cloud-pc
   gather_facts: false
+  vars:
+    pve_monitoring_legacy_provisioning_enabled: >-
+      {{ homelab_services['monitoring'].provisioner != 'tofu' }}
+  pre_tasks:
+    - name: Skip legacy monitoring provisioning after cutover
+      ansible.builtin.meta: end_play
+      when: not (pve_monitoring_legacy_provisioning_enabled | bool)
   tasks:
     - name: Read monitoring LXC configuration
       ansible.builtin.command: pct config 146