fix: gate the remaining migrated creation plays behind provisioner != tofu

pve-emergency-bot.yml, pve-monitoring.yml and pve-docker-test.yml still ran
their creation plays unconditionally. Invoking make deploy-<svc> would pct
start / pct reboot the stopped OLD VMID (148/146/145) on its production IP,
colliding with the live tofu-managed container.

Add the same pre_tasks `meta: end_play` guard the other seven migrated services
already carry: skip while homelab_services['<svc>'].provisioner == 'tofu',
override with -e pve_<svc>_legacy_provisioning_enabled=true for an intentional
legacy rollback. Verified with --check: both plays in each file end immediately,
no pct calls.

Config for these three lives elsewhere (emergency-access.yml, uptime-kuma.yml,
pve-docker-test.yml play 2), so gating the creation plays makes the files
full no-ops under tofu, like pve-gyro.yml.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V

ansible/playbooks/pve-monitoring.yml

@@ -1,4 +1,12 @@
 ---
+# После переезда на OpenTofu (tofu/svc-monitoring.tf, VMID 155) обе play здесь —
+# legacy: они таргетят СТАРЫЙ VMID 146 на боевом адресе 192.168.1.30, а вторая
+# делает pct reboot 146. Пропускаем, пока реестр говорит provisioner: tofu.
+# Конфигурация (Uptime Kuma) в этот плейбук не входит — она в
+# playbooks/uptime-kuma.yml. Замороженный Prometheus-стек в новый контейнер не
+# разворачивался. Для намеренного legacy rollback:
+#   -e pve_monitoring_legacy_provisioning_enabled=true
+
 - name: Create monitoring LXC on cloud-pc
   hosts: localhost
   connection: local
@@ -7,6 +15,8 @@
   vars:
     ansible_become: false
     ansible_python_interpreter: "{{ ansible_playbook_python }}"
+    pve_monitoring_legacy_provisioning_enabled: >-
+      {{ homelab_services['monitoring'].provisioner != 'tofu' }}
     pve_lxc_vmid: 146
     pve_lxc_node: cloud-pc
     pve_lxc_hostname: monitoring
@@ -20,12 +30,23 @@
     pve_lxc_features:
       - nesting=1
     pve_lxc_ostemplate: local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst
+  pre_tasks:
+    - name: Skip legacy monitoring provisioning after cutover
+      ansible.builtin.meta: end_play
+      when: not (pve_monitoring_legacy_provisioning_enabled | bool)
   roles:
     - role: pve_lxc
 
 - name: Enable Docker keyctl feature for monitoring LXC
   hosts: cloud-pc
   gather_facts: false
+  vars:
+    pve_monitoring_legacy_provisioning_enabled: >-
+      {{ homelab_services['monitoring'].provisioner != 'tofu' }}
+  pre_tasks:
+    - name: Skip legacy monitoring provisioning after cutover
+      ansible.builtin.meta: end_play
+      when: not (pve_monitoring_legacy_provisioning_enabled | bool)
   tasks:
     - name: Read monitoring LXC configuration
       ansible.builtin.command: pct config 146