docs(node): name the exact Ansible command that applies the pin, not 'run the play'

Node configuration in this project is Ansible's — declared in the inventory, reviewed,
version-controlled — and for prod it is the ONLY surface: infra/PROD-PROVISIONING.md
records prod as 3x bare metal with the dev OpenTofu -> Proxmox -> cloud-init path
explicitly not applying, so there is no tofu/cloud-init half to keep in parity for an
/etc/hosts pin.

The pin was already in the right place; what the docs lacked was the command. All four
places now carry the scoped, idempotent one:

    cd infra/ansible && ansible-playbook playbooks/node-baseline.yml \
      -e k3s_hosts=k3s_prod --tags hosts

--tags hosts runs ONLY the /etc/hosts task, so applying this pin cannot drift any other
baseline setting.

Also verified the mechanism is not inert, which is the failure mode this repo keeps
meeting: roles/node_baseline/tasks/main.yml renders node_baseline_hosts_pins into a marked
blockinfile with backup: true, and state: absent when the list empties — so a removed
entry really does leave the node.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

platform/pm-agent/README.md

@@ -67,8 +67,10 @@ Both are deliberate, and both fail **visibly** rather than silently:
      `x509: certificate is not valid for any names`. The Gateway, the wildcard certificate
      and the digest were never implicated. The fix is the pin this repository already uses
      for the Keycloak issuer, for the identical reason: `gitea.{{ k3s_base_domain }}` is now
-     in `node_baseline_hosts_pins`. **An operator must run the `node_baseline` play for it
-     to reach the nodes.**
+     in `node_baseline_hosts_pins` — node configuration is Ansible's, declared in the
+     inventory, never typed on a node. Apply it scoped to that one task:
+     `cd infra/ansible && ansible-playbook playbooks/node-baseline.yml -e k3s_hosts=k3s_prod
+     --tags hosts`.
    - **The pull is still unauthenticated** once the node reaches the right endpoint. An
      unauthenticated client gets nothing from this Gitea's registry, and there is no
      `imagePullSecret` anywhere in the tree. Consistent with the agent credential decision