Phase 1 T-1.4 DONE: Flux reconciling clusters/dev from host Gitea

host-prereqs.yml opened the firewall (via the operator's ansible-vault become
password); Flux GitRepository READY=True (main@sha1:a2f3bdc). Commit the
encrypted hypervisor vault (ansible_become_password) so rebuild is fully
hands-off; passphrase stays out-of-repo. platform/apps still not reconciled.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

infra/ansible/inventory/group_vars/hypervisor/vault.yml

@@ -0,0 +1,7 @@
+$ANSIBLE_VAULT;1.1;AES256
+39346534623335313934643366643533306236663431656530363566393162623564623339346230
+3032623531306264356263396638633935616534633130350a646465663861393862356261383938
+37396335333338313435313831623238663937646436366332323266323561336664396536336335
+6339386664656139380a373663316565376633313234653037633066393361613565343064393766
+30623430616235373534396665333834633662313362633837656562663061653730383464333339
+3563633139633731393330363333373161623739623762343266