Add strict read-only Dynu DNS inventory integration

infrastructure/ansible/README.md

@@ -24,6 +24,7 @@ This is intentionally a **foundation stage**, not full production automation.
 - `inventory/group_vars/` - shared/group variables.
 - `inventory/host_vars/` - per-host variables.
 - `playbooks/ping.yml` - minimal syntax/connection test playbook.
+- `playbooks/dns-inventory.yml` - local-only Dynu DNS read-only inventory wrapper.
 - `collections/requirements.yml` - lightweight baseline collections.
 - `roles/` - reserved for future incremental role adoption.
 
@@ -37,6 +38,7 @@ ansible-lint --version
 ansible-galaxy collection install -r infrastructure/ansible/collections/requirements.yml -p infrastructure/ansible/collections
 ansible-inventory -i infrastructure/ansible/inventory/hosts.yml --list
 ansible-playbook -i infrastructure/ansible/inventory/hosts.yml infrastructure/ansible/playbooks/ping.yml --syntax-check
+ansible-playbook -i infrastructure/ansible/inventory/hosts.yml infrastructure/ansible/playbooks/dns-inventory.yml --syntax-check
 ```
 
 ## Secrets and safety

infrastructure/ansible/playbooks/dns-inventory.yml

@@ -0,0 +1,26 @@
+---
+# This integration is intentionally read-only.
+# No Dynu mutations are permitted in this repo at this stage.
+- name: Build Dynu DNS read-only inventory artifacts
+  hosts: localhost
+  connection: local
+  gather_facts: false
+  vars:
+    repo_root: "{{ playbook_dir }}/../../.."
+
+  tasks:
+    - name: Assert read-only guard variable is set
+      ansible.builtin.assert:
+        that:
+          - lookup('ansible.builtin.env', 'DYNU_READ_ONLY') == 'true'
+        fail_msg: "Refusing to run: DYNU_READ_ONLY must be exactly 'true'."
+
+    - name: Fetch Dynu DNS (GET-only script)
+      ansible.builtin.command: python3 scripts/dynu/fetch_dynu_dns.py
+      args:
+        chdir: "{{ repo_root }}"
+
+    - name: Correlate Dynu with Traefik and generate docs
+      ansible.builtin.command: python3 scripts/dynu/correlate_dynu_with_traefik.py
+      args:
+        chdir: "{{ repo_root }}"