Merge remote-tracking branch 'origin/main' into codex/p0-obs-002-20260715

ops/config/service-registry.yaml

@@ -151,6 +151,20 @@ services:
     containers: ["alertmanager"]
 
   # ─── AUTO：無狀態，允許自動修復 ──────────────────────────────────────
+  - name: wazuh-manager
+    canonical_id: "service:wazuh-manager"
+    display_name: "Wazuh Manager (host_112)"
+    host: "192.168.0.112"
+    stateful_level: AUTO
+    asset_domain: host_systemd
+    reason: "Only the bounded no-write posture catalog is enabled; active response and arbitrary service mutation remain unavailable"
+    executor: host_ansible_executor
+    verifier: iwooos_wazuh_controlled_executor_runtime
+    aliases: ["wazuh-manager.service"]
+    containers: []
+    allowed_catalog_ids:
+      - ansible:wazuh-manager-posture-readback
+
   - name: nginx
     display_name: "Nginx (反向代理)"
     host: "192.168.0.110"