Wire ansible-vault for host become password (unattended host-prereqs)

Where the sudo password goes, codified:
- inventory: new [hypervisor] group (localhost, connection=local).
- host-prereqs.yml targets 'hypervisor'; become password from vaulted
  group_vars/hypervisor/vault.yml (ansible_become_password) — user creates it
  encrypted (safe to commit); README documents the exact commands.
- ansible.cfg vault_password_file = ~/.config/home-k3s/ansible-vault-pass
  (passphrase kept OUTSIDE the repo, never committed).
- ci/yamllint.yaml ignores **/vault.yml (vault blob isn't parseable YAML).
Nodes keep NOPASSWD sudo (group_vars/all) — vault scoped to the host only.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

infra/ansible/playbooks/host-prereqs.yml

@@ -9,9 +9,8 @@
 # Idempotent: safe to re-run; only changes what isn't already in the desired state. Uses
 # firewall-cmd directly (no extra Ansible collection dependency).
 - name: Configure host prerequisites for the local dev cluster
-  hosts: localhost
-  connection: local
-  become: true
+  hosts: hypervisor          # localhost (connection=local set in inventory)
+  become: true               # ansible_become_password from vaulted group_vars/hypervisor/vault.yml
   gather_facts: false
   vars:
     # The bootstrap Gitea (bootstrap/gitea/) runs on the host; the in-cluster Flux must reach it