fix(integration): exclude transient .run/ from linters; --- in generated inventory

Running the harness leaves tests/integration/.run/ (gitignored, generated); exclude it from yamllint + ansible-lint so a post-run 'make lint' passes. Also emit a --- doc-start in the generated inventory.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.ansible-lint

@@ -6,6 +6,7 @@ exclude_paths:
   - .venv/
   - .collections/
   - .scaffold/
+  - tests/integration/.run/   # transient harness run dir (gitignored, generated)
   - "**/vault.yml"  # ansible-vault encrypted — not lintable YAML
 
 # Warn only (don't fail) on these rules during initial setup

.yamllint

@@ -24,4 +24,5 @@ ignore: |
   .venv/
   .collections/
   .scaffold/
+  tests/integration/.run/
   **/vault.yml

scripts/integration-vm.py

@@ -94,6 +94,7 @@ def profile_path(host):
 
 def render_run_hosts(name, ip, ansible_user, groups):
     lines = [
+        "---",
         "# Generated by scripts/integration-vm.py — transient, gitignored. Do not edit.",
         "# Single test host ONLY (safety invariant: no real host is ever in scope).",
         "all:",