docs: pin deploy identity and archive BondTrack evidence

[Reedtrullz]

Summary

• 7382d6d pins the Heimdall SSH identity (IdentitiesOnly=yes) in the Ansible inventory and deploy/runbook examples, and updates the documented native prebuild versions.
• 2f9e08e archives the BondTrack predecessor audit/QA evidence under docs/archive/bondtrack-predecessor-2026-08-23/ with provenance, hashes, and explicit credential/token exclusions.
• Candidate head: 2f9e08e (base master at b5855b4).

Validation evidence

• PASS — npm run check:native-prebuild-pins (Native linux prebuild pins match package-lock.json.)
• PASS — ansible-inventory -i inventory/hosts.yml --list --vault-password-file ~/.vault_pass.txt
• PASS — ansible-playbook -i inventory/hosts.yml ansible-playbook.yml --syntax-check --vault-password-file ~/.vault_pass.txt
• PASS — git diff --check for the live modified files (CLAUDE.md, DEPLOYMENT.md, inventory/hosts.yml).
• git diff --check origin/master...HEAD reports Markdown hard-break trailing spaces and a new blank line at EOF in historical archived reports (UI_UX_AUDIT_REPORT.md and dogfood-output-report-2026-05-04.md); these are documentation-only archive findings and remain disclosed here.
• Added-path/line scans found no credential files or secret material; the archive manifest explicitly excludes credentials, tokens, environment files, and build/browser state.

Blockers / boundaries

• Full npm ci, lint, unit, build, and E2E gates were not run for this candidate.
• No deploy, production endpoint, image, or runtime verification was performed.
• Existing Dependabot PRs currently have failing checks: #21 fails Unit tests, Next.js build, and Playwright E2E; #20 fails Unit tests and Playwright E2E (Docker/publish checks are skipped). Treat these as CI blockers until independently resolved.

This PR intentionally remains draft. Do not merge or deploy from it.