feat: add gated Compose deploy and make inventory the host source of truth

Keep sanitized Compose sources in-repo with a confirmation-gated Ansible
playbook, add repo-wide validation, tighten runbook ownership/STOP/review
metadata, and archive stale research docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

runbooks/mailcow-update.md

@@ -9,6 +9,12 @@ Update the mailcow stack on mx2 to the latest supported release.
 - Applicable: [mx2.windy.me](../hosts/mx2.windy.me.md), `/opt/mail`.
 - Not applicable: config changes beyond the update, DB migration, secret rotation.
 
+## Ownership
+
+- Owner: personal ops (Windy)
+- Last reviewed: 2026-08-17
+- Related systems: mx2.windy.me (`/opt/mail`)
+
 ## Approval gates
 
 | Action | Risk | Explicit approval |
@@ -24,6 +30,7 @@ Path: `/opt/mail`
 - Never run the update without explicit user confirmation.
 - Never pass secrets into the chat log; do not commit `mailcow.conf`.
 - If a step fails, capture `docker compose ps` and logs and stop before further changes.
+- If live state conflicts with this runbook's assumptions (e.g. unexpected `mailcow.conf` values), `STOP` and report.
 
 ## Before