---
# FINAL step: hand off to Flux + SOPS (T-1.4). Calls into bootstrap/ (authored by
# the Security + GitOps Engineers) — this play does not author that subtree.
- name: Flux + SOPS bootstrap hand-off
  hosts: k3s_servers
  become: false
  gather_facts: false
  roles:
    - role: flux_bootstrap