homelab client add/remove: surgical inventory edits (preserve comments)

yaml.safe_load + safe_dump stripped every comment from inventory.yaml
on each enrollment, eroding the file's documentation value. New
_inventory_set_age_pubkey / _inventory_remove_host / _inventory_append_host
helpers do line-based edits so comments outside the modified region
survive. inventory.yaml gets its top-of-file conventions block back.

build_host_files.py round-trips cleanly (--check returns 0).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

inventory.yaml

@@ -1,3 +1,24 @@
+# Homelab inventory — canonical structured topology.
+#
+# Single source of truth. hosts/*.yaml is generated from this file by
+# mcp/build_host_files.py; do NOT edit those by hand.
+#
+# Conventions:
+#   - hostname keys MUST match the actual `hostname` of the machine (on
+#     macOS: `scutil --get LocalHostName` if set).
+#   - `os:` one of: linux, macos
+#   - `kind:` one of: proxmox-host, lxc, vm, workstation
+#   - `mesh:` lists addresses the host is reachable at. Both `netbird` and
+#     `tailscale` are accepted during the migration (see infrastructure/mesh.md).
+#     Prefer netbird FQDNs over raw IPs.
+#   - `age_pubkey:` provisioned by secrets-issuance on first bootstrap and
+#     committed back via `homelab client add --finalize-pubkey <key>`.
+#   - When a service moves hosts, update only the `services:` section here;
+#     never duplicate addresses elsewhere.
+#
+# `homelab client add/remove` does surgical line-edits — comments survive.
+# Avoid round-tripping the file through yaml.safe_dump (it strips comments).
+
 mesh:
   primary: netbird
   accepted: