Merge remote-tracking branch 'origin/main' into codex/sre-typed-automation-20260715

# Conflicts:
#	apps/api/tests/test_executor_trust_boundary_readback.py

apps/api/src/core/config.py

@@ -836,8 +836,8 @@ class Settings(BaseSettings):
     ENABLE_IWOOOS_WAZUH_MANAGER_POSTURE_EXECUTOR: bool = Field(
         default=False,
         description=(
-            "True=periodically enqueue the allowlisted no-write Wazuh manager "
-            "posture playbook into the existing Ansible controlled executor."
+            "True=periodically converge the allowlisted Wazuh sanitized alert "
+            "ingress before enqueueing the no-write manager posture playbook."
         ),
     )
     IWOOOS_WAZUH_MANAGER_POSTURE_FRESHNESS_HOURS: int = Field(
@@ -845,7 +845,7 @@ class Settings(BaseSettings):
         ge=1,
         le=24,
         description=(
-            "Minimum freshness window between Wazuh manager posture executor runs."
+            "Minimum freshness window between Wazuh ingress and posture runs."
         ),
     )
     AWOOOP_ANSIBLE_CONTROLLED_APPLY_ALLOWED_RISK_LEVELS: str = Field(
@@ -901,6 +901,13 @@ class Settings(BaseSettings):
         default="/etc/ssh-mcp/known_hosts",
         description="known_hosts path for Ansible check-mode SSH transport.",
     )
+    AWOOOP_ANSIBLE_BECOME_PASSWORD_FILE: str = Field(
+        default="/run/secrets/host112-become/password",
+        description=(
+            "Optional Ansible become password file. The value is consumed by "
+            "Ansible through its password-file contract and never placed in argv."
+        ),
+    )
     AWOOOP_ANSIBLE_CHECK_MODE_CANDIDATE_MAX_AGE_HOURS: int = Field(
         default=24,
         ge=1,