docs(node_baseline): say why the Longhorn claim guard's swap list is now always empty

The claim guard builds node_baseline_lh_protected_devices from ansible_mounts plus
`swapon --show`. With swap.target masked, a baselined node has no active swap, so
that half of the list contributes nothing — which reads like a guard that quietly
stopped guarding. It is not: the claim candidate comes from whatever is mounted at
node_baseline_longhorn_claim_mountpoint, and a swap partition is neither mounted nor
ext4, so it could never be the candidate. Say so where the next reader will ask.

Co-Authored-By: Claude Opus 5 <[email protected]>

infra/ansible/roles/node_baseline/tasks/disks.yml

@@ -331,6 +331,15 @@
 # The devices this role must never, under any circumstances, hand to e2label. Built from
 # gathered facts (`gather_facts: true` in the play) plus the live swap list, so it is the
 # NODE's account of what is load-bearing, not a hardcoded list of partition names.
+#
+# EXPECT THIS LIST TO BE EMPTY. Since the swap tasks in tasks/main.yml mask swap.target,
+# a baselined node has no active swap for `swapon` to report, so the swap half of
+# node_baseline_lh_protected_devices below contributes nothing. That is not a weakened
+# guard: the claim CANDIDATE is derived from whatever is mounted at
+# node_baseline_longhorn_claim_mountpoint, and a swap partition is neither mounted nor an
+# ext4 filesystem, so it can never be the candidate in the first place. The task stays
+# because the list must be the node's own account of what is load-bearing — including on
+# a node reached before baseline has run, or one an operator has deliberately swapped on.
 - name: "Longhorn (claim): list the devices currently backing active swap"
   ansible.builtin.command: swapon --noheadings --show=NAME
   register: node_baseline_lh_swapdevs