fix: gate the remaining migrated creation plays behind provisioner != tofu

pve-emergency-bot.yml, pve-monitoring.yml and pve-docker-test.yml still ran
their creation plays unconditionally. Invoking make deploy-<svc> would pct
start / pct reboot the stopped OLD VMID (148/146/145) on its production IP,
colliding with the live tofu-managed container.

Add the same pre_tasks `meta: end_play` guard the other seven migrated services
already carry: skip while homelab_services['<svc>'].provisioner == 'tofu',
override with -e pve_<svc>_legacy_provisioning_enabled=true for an intentional
legacy rollback. Verified with --check: both plays in each file end immediately,
no pct calls.

Config for these three lives elsewhere (emergency-access.yml, uptime-kuma.yml,
pve-docker-test.yml play 2), so gating the creation plays makes the files
full no-ops under tofu, like pve-gyro.yml.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V

ansible/playbooks/pve-emergency-bot.yml

@@ -1,4 +1,10 @@
 ---
+# После переезда на OpenTofu (tofu/services.tf, VMID 151) обе play здесь —
+# legacy: они таргетят СТАРЫЙ VMID 148 на боевом адресе 192.168.1.32.
+# Пропускаем, пока реестр говорит provisioner: tofu. Конфигурация emergency-bot
+# в этот плейбук не входит — она в playbooks/emergency-access.yml. Для
+# намеренного legacy rollback: -e pve_emergency_bot_legacy_provisioning_enabled=true
+
 - name: Create emergency-bot LXC on mini-pc
   hosts: localhost
   connection: local
@@ -7,6 +13,8 @@
   vars:
     ansible_become: false
     ansible_python_interpreter: "{{ ansible_playbook_python }}"
+    pve_emergency_bot_legacy_provisioning_enabled: >-
+      {{ homelab_services['emergency-bot'].provisioner != 'tofu' }}
     pve_lxc_vmid: 148
     pve_lxc_node: mini-pc
     pve_lxc_hostname: emergency-bot
@@ -18,12 +26,23 @@
     pve_lxc_swap: 256
     pve_lxc_startup: order=70
     pve_lxc_ostemplate: "{{ lookup('env', 'PVE_LXC_OSTEMPLATE') | default('local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst', true) }}"
+  pre_tasks:
+    - name: Skip legacy emergency-bot provisioning after cutover
+      ansible.builtin.meta: end_play
+      when: not (pve_emergency_bot_legacy_provisioning_enabled | bool)
   roles:
     - role: pve_lxc
 
 - name: Wait for emergency-bot SSH
   hosts: emergency-bot
   gather_facts: false
+  vars:
+    pve_emergency_bot_legacy_provisioning_enabled: >-
+      {{ homelab_services['emergency-bot'].provisioner != 'tofu' }}
+  pre_tasks:
+    - name: Skip legacy emergency-bot provisioning after cutover
+      ansible.builtin.meta: end_play
+      when: not (pve_emergency_bot_legacy_provisioning_enabled | bool)
   tasks:
     - name: Wait for emergency-bot to accept SSH connections
       ansible.builtin.wait_for_connection: