RCLUSTER-WP-0019: keep registries.yaml root 0600 (found world-readable with registry login)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61

ansible/k3s-kubeconfig-mode.yml

@@ -305,3 +305,19 @@
             success_msg: >-
               admin kubeconfig {{ kubeconfig_stat.stat.pw_name }}:{{ kubeconfig_stat.stat.gr_name }}
               {{ kubeconfig_stat.stat.mode }}; API ready
+
+        # registries.yaml can hold registry logins; it was found 0644 on 2026-10-20
+        # by the RAIL-HO-WP-0014 posture check. k3s reads it as root at startup.
+        - name: Stat registries.yaml (metadata only)
+          ansible.builtin.stat:
+            path: /etc/rancher/k3s/registries.yaml
+            get_checksum: false
+          register: registries_stat
+
+        - name: Restrict registries.yaml to root (0600) when present
+          ansible.builtin.file:
+            path: /etc/rancher/k3s/registries.yaml
+            owner: root
+            group: root
+            mode: "0600"
+          when: k3s_kubeconfig_mode_action == 'apply' and registries_stat.stat.exists