Implement reproducible S1 handoff contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

inventory/group_vars/secrets.sops.yaml

@@ -1,3 +0,0 @@
-# Encrypt this file with SOPS before committing!
-ops:
-  hcloud_token: "hc_XXXXXXXXXXXXXXXXXXXXXXXXXXXX"  # replace; then run: sops --encrypt --in-place inventory/group_vars/secrets.sops.yaml

inventory/servers.yaml

@@ -1,8 +1,15 @@
+schema_version: "1.0"
 servers:
   - name: CoulombCore
+    provider: hosteurope
+    lifecycle_mode: adopted
     ip: 92.205.130.254
     ssh_user: tegwick
     ssh_key: ~/.ssh/id_ops
+    baseline_profile: external-firewall
   - name: Railiance01
+    provider: hosteurope
+    lifecycle_mode: adopted
     ip: 92.205.62.239
     ssh_user: tegwick
+    baseline_profile: ufw-managed