Accept cloud-init rc 2 (recoverable errors) in the k3s play

PVE's cloud-init user-data triggers a deprecation warning that makes
`cloud-init status --wait` exit 2 even though provisioning succeeded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/mgmt.yml

@@ -91,7 +91,10 @@
   tasks:
     - name: Wait for cloud-init to finish (apt lock, SSH keys)
       ansible.builtin.command: cloud-init status --wait
+      register: cloud_init
       changed_when: false
+      # rc 2 = done with recoverable errors; PVE's user-data triggers a deprecation warning ('user' as string)
+      failed_when: cloud_init.rc not in [0, 2]
 
     - name: Install qemu-guest-agent
       ansible.builtin.apt:

docs/plans-executions/2026-09-27-0058-mgmt-cluster-ansible.md

@@ -75,3 +75,14 @@ ansible-playbook mgmt.yml --tags vm
 `--nameserver '{{ mgmt_dns | join(' ') }}'` as one argument (space-separated is PVE's format for
 the cloud-init nameserver list). Image download and key staging had already succeeded and are
 idempotent on re-run; `qm status 201` confirmed no half-created VM was left behind.
+
+### `--tags vm` second attempt, `--tags k3s` first attempt (2026-09-27 ~09:39 CEST, owner)
+
+`--tags vm` created VM 201; the owner logged in as `ubuntu`. `resolvectl dns` on the VM shows
+`eth0: 8.8.8.8 2.2.2.2`, so PVE's space-separated nameserver list works.
+
+`--tags k3s` failed on the first task: `cloud-init status --wait` → `status: done`, rc 2.
+`cloud-init status --long` showed `extended_status: degraded done`, `errors: []`, and only a
+recoverable DEPRECATED warning: PVE's generated user-data sets `user:` as a string (deprecated
+since cloud-init 22.2). rc 2 = "done with recoverable errors", so the task now fails only on rc
+other than 0/2.