Document Ansible-built management cluster (plan step 4)

Phase-1 Step 2 rewritten around ansible/mgmt.yml and cluster-api-operator,
version pins for operator/cert-manager/cloud image, decisions #12-14,
execution log and changelog. Phase-1 Step 2 checked off.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/plans-executions/2026-09-27-0058-mgmt-cluster-ansible.md

@@ -7,8 +7,8 @@ Pairs with [docs/plans/2026-09-27-0058-mgmt-cluster-ansible.md](../plans/2026-09
 - [x] Step 0 — Initial import commit + plan commit
 - [x] Step 1 — Scaffold `ansible/`, `.gitignore` exception, syntax/lint checks
 - [x] Step 2 — Run the playbook tag by tag against the lab (owner)
-- [ ] Step 3 — Idempotency check (second full run `changed=0`)
-- [ ] Step 4 — Docs, versions, decisions, changelog
+- [x] Step 3 — Idempotency check (second full run `changed=0`)
+- [x] Step 4 — Docs, versions, decisions, changelog
 
 ## Step 0 — Initial import + plan
 
@@ -56,7 +56,7 @@ uvx --from 'ansible-core>=2.18,<2.19' ansible pve -m ping -o
   Play 1 asserts on them.
 - `clusterctl` is not installed on the laptop either (needed for phase-1 Step 3, not for this playbook).
 
-## Step 2 — Playbook runs (in progress)
+## Step 2 — Playbook runs
 
 ### `--tags vm`, first attempt (2026-09-27 09:30 CEST, owner)
 
@@ -111,7 +111,7 @@ full playbook run re-applies it via the `inspector` task (`--apply-rbac`).
 **Worth noting:** the `.claude/settings.json` allowlist picked up four one-off entries approved
 during this check (`export KUBECONFIG=…`, three exact `kubectl … logs` commands).
 
-## Step 3 — Idempotency check (in progress)
+## Step 3 — Idempotency check
 
 ### Full run: `Apply provider manifests` always `changed` (2026-09-27 10:35 CEST)
 
@@ -135,3 +135,33 @@ Also from this check: the widened inspector RBAC was not applied yet (`get nodes
 Forbidden), so no clean full run had completed before this fix. `clusterctl` v1.12.11
 darwin/arm64 is installed in `~/bin`; `clusterctl generate cluster lab1 --infrastructure proxmox:v0.9.1 --target-namespace default --list-variables`
 lists no `PROXMOX_*` credentials, confirming `clusterctl.yaml` only needs workload values now.
+
+### Result (2026-09-27 ~10:38 CEST, owner)
+
+After the `data` fix, one run with the expected `changed` on the Secret, then:
+
+```text
+PLAY RECAP
+lab-mgmt : ok=19 changed=0 unreachable=0 failed=0 skipped=2
+pv1-1    : ok=3  changed=0 unreachable=0 failed=0 skipped=6
+```
+
+Verified read-only with `lab-mgmt-ro`: node `lab-mgmt` Ready (v1.35.8+k3s1, Ubuntu 24.04.5);
+all five Provider CRs `READY True` at v1.12.11 / v0.9.1 / v1.1.1; HelmCharts cert-manager v1.21.2
+and cluster-api-operator 0.28.0 not failed; `auth can-i delete machines` / `get secrets` → `no`.
+The widened inspector RBAC was applied by this run's `inspector` task.
+
+## Step 4 — Docs (2026-09-27 10:40 CEST)
+
+- `docs/phase-1-proxmox-capi.md`: Step 2 rewritten around the playbook (prereqs incl. `clusterctl`
+  darwin/arm64 install into `~/bin`, tag-by-tag commands, operator rules), checklist ticked,
+  topology row, 4 troubleshooting rows (provider not Ready, stale cache #1075, token rotation,
+  non-idempotent task).
+- `docs/versions.md`: cluster-api-operator 0.28.0, cert-manager v1.21.2, cloud image serial;
+  provider upgrade procedure.
+- `docs/decisions.md` #12–14; `CLAUDE.md` lab fact + version rules (no `clusterctl init/upgrade/move/delete`);
+  `configs/capi/clusterctl.yaml.example` without controller credentials; README status, layout, decision 6.
+
+**Worth noting:** the mgmt VM runs Ubuntu 24.04.5 (cloud image), the node template 24.04.4
+(ISO) — different on purpose, they're separate images. Not covered by the plan and still open:
+token rotation, VM resize, re-creating the VM (SSH `known_hosts` would conflict with `accept-new`).