feat: add gated Compose deploy and make inventory the host source of truth

Keep sanitized Compose sources in-repo with a confirmation-gated Ansible
playbook, add repo-wide validation, tighten runbook ownership/STOP/review
metadata, and archive stale research docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

runbooks/home-assistant-maintenance.md

@@ -21,6 +21,12 @@ read-only checks and gated mutating operations; the "Command families
 intentionally NOT scripted" table below lists what is deliberately out of
 scope.
 
+## Ownership
+
+- Owner: personal ops (Windy)
+- Last reviewed: 2026-08-17
+- Related systems: hass.windy.lan (HAOS, `machine: green`)
+
 ## Safety
 
 - Prefer read-only checks first; the health snapshot mutates nothing.
@@ -33,6 +39,8 @@ scope.
   state via Supervisor (`SUPERVISOR_TOKEN` after `sudo -n -i`).
 - The `--restart-core` wrapper exits 1 silently on ssh failure — treat an
   empty/exit-1 result as failure and confirm with `ha core info`.
+- If live state conflicts with a documented expectation, `STOP` and report;
+  do not improvise command families outside this script.
 
 ## Access pattern