[wax911]

Refs #652 and #656

Problem

The host baseline and remaining migration work need a portable handoff. VM/cloud acceptance cannot run with the currently supplied inputs, but development, local verification and operator documentation can continue without pretending those gates passed.

What changed

• Retain the strict inventory/trust adapter, Ubuntu host/storage/Tailscale/firewall roles and container/VM verification added by this stacked PR.
• Add a read-only platform-evidence-validate command for existing Docker lab and VM host-baseline reports, with strict schemas, exact environment/tier/commit, required passing steps, observed host idempotence, complete cleanup and consistent resource/image/architecture/revision evidence.
• Reject incomplete, blocked, failed, mismatched, duplicate-key, unsupported and recognizable-secret-bearing reports without echoing secret values. Successful output is explicitly scoped, not authenticity, arbitrary-secret scanning, current-host-state proof or G0-G6 approval.
• Add a five-part zero-setup runbook set at docs/platform/runbooks/README.md: Ubuntu/macOS workstation setup, accounts and pinned tooling; P0 inventory and trusted VM/provider acceptance; P2/P3 development and operator procedures; rehearsal, cutover, pre/post-write recovery, soak, retention and handover.
• Provide per-issue prerequisites, input acquisition, least-privilege credential handling, expected outputs, failure recovery, acceptance evidence and delegation checklists. Required but unavailable interfaces are labelled unimplemented, not presented as working deployments.
• Link the separately published P0 collector PR feat(platform): add read-only inventory collection contracts #673 and its portable acquisition instructions, rather than depend on the original workstation's draft.

Verification

• PLATFORM_VENV=/tmp/omp-platform-lab-654-testenv make platform-pulumi-test ENV=lab: 2 Docker-provider tests, 16 HCloud tests and 127 platform Python tests passed. The 44 evidence cases include failing-before/passing-after regressions for reviewed identity and consistency gaps.
• Exercised the new Make command against a retained actual Docker lifecycle report from commit 5ec5f374d29f8bd4f90679b33282c0088e5b1c6d: scoped validation passed. This was not a new provider lifecycle run. A retained incomplete report and presenting Docker evidence as VM evidence were rejected with exit 2.
• Executed the runbook's actual trust-root/signing scripts with synthetic inventory through ansible_inventory.py: valid signed input accepted, altered signed input rejected, generated known_hosts mode 0600; no VM connection.
• Checked all runbook shell blocks with bash -n, embedded Python syntax and local Markdown file links. Clean-OS installation and VM/cloud commands were not executed.
• /tmp/omp-platform-lab-654-testenv/bin/python -m py_compile tools/platform/evidence.py: passed.
• Existing unchanged baseline proof before this increment: Docker-backed Molecule completed all 10 actions and namespace-local iptables smoke verified apply/idempotence/drift repair and preserved IPv6 INPUT. These are not substituted for actual VM acceptance.

Safety and remaining gates

• Stacked on feat/platform-hcloud-655 (PR feat(platform): add protected HCloud provisioning and preview #670); feat(platform): add protected HCloud provisioning and preview #670 is stacked on feat(platform): phase 1 add an isolated Docker lab and validation contract #669, which is stacked on docs(platform): define phased Pulumi, Ansible and Dokploy migration #651. Keep the recorded stack base and retarget through normal review after predecessor merges.
• No cloud apply, production traffic change, data deletion or VM host mutation was performed. The P0 collector's separate new run was read-only and remained explicitly G0 blocked.
• Actual VM inventory/trust/SSH/Tailscale inputs are still unavailable. Full VM storage, networking, Tailscale, reboot/reconnect and subsequent Dokploy/application/restore/promotion acceptance remain unverified.
• P2/P3 application integration code is not implemented by these runbooks. Their development and later operational acceptance are assigned explicitly in the handoff.
• HCloud apply remains blocked until G0 supplies and authorizes the required outbound policy. Rehearsal/canary/cutover/retirement need their separate concrete approvals and evidence.
• This PR remains draft while required runtime/predecessor/review gates are outstanding. It does not close feat(ansible): phase 1 add an idempotent host baseline with container and VM tests #656 or the parent feat(platform): track the phased AniTrend private platform migration #652.