docs(prod): correct sudo posture to vaulted become; record status-surface ruling

Two operator corrections:

1. PROD DOES NOT GET NOPASSWD SUDO. My initial checklist recommended mirroring dev's
   passwordless sudo onto prod — rejected, correctly. Dev's NOPASSWD is a convenience
   that must not propagate to production. Prod instead keeps a real sudo boundary and
   drives Ansible `become` with an ansible-vault-encrypted `ansible_become_password` in
   inventory/group_vars/k3s_prod/vault.yml, mirroring the EXISTING hypervisor and
   proxmox_hosts groups. The decrypting passphrase stays outside the repo at
   ~/.config/home-k3s/ansible-vault-pass (ansible.cfg :: vault_password_file), so plays
   still run unattended with no plaintext secret in git.

2. THE TASK BOARD IS NOT THE STATUS SURFACE — THE REPOSITORY IS. Operator ruling closes
   the escalation raised in the previous commit. Requirement/spec status is to be DERIVED
   from repo state (what is authored, reconciled, and covered by a green requirement-tagged
   test), not from a hand-maintained board. The spec board is left as a historical seed;
   no agent edits it and no SPEC_PIN churn is spent on it. ci/spec-immutability.sh keeps
   its full strictness — no path exception was added, since weakening an R-TEST-06 gate
   for a bookkeeping file would be a defect, not a fix. A repo-derived spec status report
   becomes the artifact of record alongside the coverage report and this log.

Serves: R-ENV-03 (prod provisioning posture), R-SEC-01 (no plaintext secrets), R-TEST-06.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

infra/PROD-PROVISIONING.md

@@ -111,14 +111,24 @@ Consequences to settle before imaging nodes 2 and 3:
 ## 5. Access (per node) — **blocks all Ansible**
 
 - [ ] **`k3s` user with the `home_network` SSH key.** Working on node 1.
-- [ ] **NOPASSWD sudo.** *Not configured on node 1* — `sudo -n` demands a password, so every
-      playbook fails at its first `become` task. Dev nodes have this; prod must match:
-      ```bash
-      # on the node, as a user who can already sudo:
-      echo 'k3s ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/90-k3s
-      sudo chmod 0440 /etc/sudoers.d/90-k3s
-      sudo visudo -c
+- [ ] **Password-protected sudo, driven by Ansible `become` + a vaulted password.**
+      **Prod does NOT use NOPASSWD sudo** (operator decision, 2026-08-31). Dev nodes do; prod
+      deliberately keeps the sudo password in place and supplies it to Ansible as an
+      **ansible-vault-encrypted** var, exactly like the existing `hypervisor` and `proxmox_hosts`
+      groups:
       ```
+      inventory/group_vars/k3s_prod/
+        README.md     how to (re)create the vault — committed
+        vault.yml     ansible_become_password: "..."  — committed, ENCRYPTED
+      ```
+      The passphrase that decrypts it lives **outside the repo** at
+      `~/.config/home-k3s/ansible-vault-pass` (`ansible.cfg :: vault_password_file`), so plays still
+      run unattended without a plaintext secret ever touching git.
+      ```bash
+      ansible-vault create inventory/group_vars/k3s_prod/vault.yml   # ansible_become_password: ...
+      ```
+      Prod nodes must therefore set `ansible_become: true` in their group_vars and must **not**
+      inherit any passwordless-sudo assumption from `group_vars/all.yml`.
 - [ ] **Drive health baseline** (§2), needs root:
       ```bash
       sudo apt-get update && sudo apt-get install -y smartmontools