Apply review fixes R12-R14: printf scaffold, phantom control/ dir, Galaxy wording

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -90,7 +90,6 @@ inventories/
       all/            # applies to every host
         vars.yml
         vault.yml
-      control/        # the control node (baseline config only)
       docker_hosts/   # hosts running Docker services
       proxmox_hosts/  # Proxmox nodes themselves
     host_vars/        # per-host overrides

Makefile

@@ -151,7 +151,7 @@ endif
 	echo "---" > roles/$(NAME)/handlers/main.yml
 	echo "---" > roles/$(NAME)/defaults/main.yml
 	echo "---" > roles/$(NAME)/meta/main.yml
-	echo "# $(NAME)\n\nRole description here." > roles/$(NAME)/README.md
+	printf '# %s\n\nRole description here.\n' "$(NAME)" > roles/$(NAME)/README.md
 	cp .scaffold/molecule.yml roles/$(NAME)/molecule/default/molecule.yml
 	cp .scaffold/converge.yml roles/$(NAME)/molecule/default/converge.yml
 	cp .scaffold/verify.yml   roles/$(NAME)/molecule/default/verify.yml

docs/decisions/006-terraform.md

@@ -37,9 +37,8 @@ to write A records, but that created a bootstrap cycle — the first DNS server
 register itself — and split DNS ownership across two tools. Ansible's `dns` role now
 owns the entire internal zone, rendered from inventory. See ADR-009.
 
-No Galaxy roles. Terraform manages its own provider dependencies via
-`required_providers` and `.terraform.lock.hcl` (tracked in git once `terraform init`
-has been run).
+Terraform manages its own provider dependencies via `required_providers` and
+`.terraform.lock.hcl` (tracked in git once `terraform init` has been run).
 
 ---