feat: add gated Compose deploy and make inventory the host source of truth

Keep sanitized Compose sources in-repo with a confirmation-gated Ansible
playbook, add repo-wide validation, tighten runbook ownership/STOP/review
metadata, and archive stale research docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

runbooks/matrix-health.md

@@ -9,6 +9,12 @@ Read-only health check of the Matrix homeserver (ESS on K3s).
 - Applicable: [synapse.chans.xyz](../hosts/synapse.chans.xyz.md), namespace `ess`.
 - Read-only: does not change pods, ingress, certificates, or configuration.
 
+## Ownership
+
+- Owner: personal ops (Windy)
+- Last reviewed: 2026-08-17
+- Related systems: synapse.chans.xyz (ESS chart `26.7.2`, K3s)
+
 Monitor the Matrix homeserver running on `synapse.chans.xyz` (ESS chart `26.7.2`, K3s node).
 
 Prefer `cd ansible && ansible-playbook playbooks/health-report.yml --limit matrix`