fix(edge-host-iso): carry the bootstrap fixes into the ISO side too

Review on #474 caught that the previous commit fixed the procedure in
ansible/roles/edge-host/README.md and left the same two defects in the two
places an operator actually reads them first.

That happened because my grep for the stale patterns ran with the working
directory set to ansible/, so `images/edge-host-iso/README.md` was a path
that did not exist. grep returned nothing and I read that as clean. A false
negative from a bad path, not a clean sweep.

Fixed now, verified from the repository root:

  airootfs/usr/local/bin/edge-install
    Printed the superseded two-command sequence at the console immediately
    after imaging -- the very first instructions anyone sees, telling them
    to run common.yml with -l edge_host. Now prints the single unrestricted
    run, plus the two steps that precede it (confirm the host resolves by
    name, add it to [edge_host]).

  README.md
    Described the image as being for `edge-1.srv.renner.uno`, a name that
    does not resolve, and repeated the same two-command bootstrap. Both
    replaced. This file is the link target of step 2 in the ansible-side
    README, so following the procedure end to end landed straight back on
    the defect #474 claims to close.

Also corrected while there: the ISO README called the target "the bare-metal
N100". edge-1 is a Wyse 3040 (Atom x5-Z8350), and the installer text further
down already says it "covers the Wyse 3040". Rewritten to describe the image
as not tied to one box or model, since the installer autodetects the target
disk -- which is what makes it usable for the second thin client.

Also from review: a comment on why `become: true` is set when the connection
is already root. Not taken -- ignore_unreachable, which common.yml sets. The
review's own reasoning applies: Ansible already skips an unreachable host and
continues with the others, so it adds nothing here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ansible/plays/install-edge-host.yml

@@ -27,6 +27,9 @@
 # by monitoring-agent, not by common.
 - name: Install Arch edge host
   hosts: edge_host
+  # Connection is already root (ansible_user=root), so this is a root-to-root
+  # no-op today. Kept explicit, matching plays/common.yml, so the roles below
+  # do not silently depend on the connection user staying privileged.
   become: true
   roles:
     - certificates

images/edge-host-iso/README.md

@@ -1,7 +1,12 @@
 # edge-host installer ISO
 
-Bootable Arch installer image for `edge-1.srv.renner.uno` (the bare-metal
-N100 that replaces the k8s-edge VM — see `ansible/roles/edge-host`).
+Bootable Arch installer image for the bare-metal edge hosts — the machines
+that replaced the k8s-edge VM, because Talos cannot do CAN or USB
+passthrough. See `ansible/roles/edge-host`.
+
+Not tied to one box or one model: the installer autodetects the target disk
+(NVMe, else eMMC, else the first non-USB disk), which covers both the Wyse
+3040 thin clients and larger hardware.
 
 The image is the official archiso **releng** profile plus:
 - `edge-install` in the live environment — partitions the NVMe
@@ -38,10 +43,16 @@ archiso updates flow in automatically.
    (NVMe, else eMMC — covers the Wyse 3040 — else first non-USB disk),
    shows the target and requires typing the hostname before wiping
    anything. Override with `edge-install /dev/sdY`.
-4. Reboot, then from the workstation:
+4. Reboot. Confirm the box is reachable by name — `ssh root@<host>` — before
+   going further; it is identified by name everywhere and its address is
+   never recorded. Then add it to `[edge_host]` in
+   `ansible/inventory/pve_hosts.yml` and, from the workstation:
    ```
    cd ansible
-   ansible-playbook -i inventory/pve_hosts.yml plays/common.yml -l edge_host
    ansible-playbook -i inventory/pve_hosts.yml plays/install-edge-host.yml
    ```
+   One run over the whole group, no `--limit`: the play carries
+   `certificates` and `common` itself, so there is no separate `common.yml`
+   step. Running it converges every edge host, which is the point — a run
+   that touches only the new box tells you nothing about the others.
 5. Continue with the cutover checklist in `ansible/roles/edge-host/README.md`.

images/edge-host-iso/airootfs/usr/local/bin/edge-install

@@ -99,7 +99,13 @@ EOF
 
 umount -R /mnt
 echo
-echo "${HOST} installed. Remove the USB stick, reboot, then from the"
-echo "workstation:  cd ansible &&"
-echo "  ansible-playbook -i inventory/pve_hosts.yml plays/common.yml -l edge_host"
-echo "  ansible-playbook -i inventory/pve_hosts.yml plays/install-edge-host.yml"
+echo "${HOST} installed. Remove the USB stick and reboot."
+echo
+echo "Then, from the workstation:"
+echo "  1. confirm 'ssh root@${HOST}' works (it must be reachable by name)"
+echo "  2. add ${HOST} to [edge_host] in ansible/inventory/pve_hosts.yml"
+echo "  3. cd ansible && ansible-playbook -i inventory/pve_hosts.yml \\"
+echo "       plays/install-edge-host.yml"
+echo
+echo "One run, whole group, no --limit: the play carries certificates and"
+echo "common itself, so there is no separate common.yml step."