fix: gate the remaining migrated creation plays behind provisioner != tofu

pve-emergency-bot.yml, pve-monitoring.yml and pve-docker-test.yml still ran
their creation plays unconditionally. Invoking make deploy-<svc> would pct
start / pct reboot the stopped OLD VMID (148/146/145) on its production IP,
colliding with the live tofu-managed container.

Add the same pre_tasks `meta: end_play` guard the other seven migrated services
already carry: skip while homelab_services['<svc>'].provisioner == 'tofu',
override with -e pve_<svc>_legacy_provisioning_enabled=true for an intentional
legacy rollback. Verified with --check: both plays in each file end immediately,
no pct calls.

Config for these three lives elsewhere (emergency-access.yml, uptime-kuma.yml,
pve-docker-test.yml play 2), so gating the creation plays makes the files
full no-ops under tofu, like pve-gyro.yml.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V

ansible/playbooks/pve-docker-test.yml

@@ -3,6 +3,13 @@
   hosts: cloud-pc
   gather_facts: false
   vars:
+    # После переезда на OpenTofu (tofu/svc-docker-test.tf, VMID 152) этот play —
+    # legacy: он таргетит СТАРЫЙ VMID 145 и его handler/"Start" сделали бы
+    # pct start 145, подняв остановленный откат на боевом адресе 192.168.1.29.
+    # Пропускаем, пока реестр говорит provisioner: tofu. Для намеренного
+    # legacy rollback: -e pve_docker_test_legacy_provisioning_enabled=true
+    pve_docker_test_legacy_provisioning_enabled: >-
+      {{ homelab_services['docker-test'].provisioner != 'tofu' }}
     docker_test_vmid: 145
     docker_test_hostname: docker-test
     docker_test_ip: 192.168.1.29/24
@@ -14,6 +21,10 @@
     - name: restart docker test lxc
       ansible.builtin.shell: "pct stop {{ docker_test_vmid }} || true; pct start {{ docker_test_vmid }}"
       changed_when: true
+  pre_tasks:
+    - name: Skip legacy docker-test provisioning after cutover
+      ansible.builtin.meta: end_play
+      when: not (pve_docker_test_legacy_provisioning_enabled | bool)
   tasks:
     - name: Check if Docker test LXC exists
       ansible.builtin.command: "pct config {{ docker_test_vmid }}"