feat(winrm): wire Ansible WinRM for morgoth+fairyland Windows GPU hosts

- ansible.sh: export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES (fixes macOS
  fork safety abort when pywinrm loads ObjC frameworks before fork())
- hosts.ini: add winrm scheme=http port=5985, transport=ntlm for Windows hosts;
  remove hardcoded ansible_user (now per-host)
- group_vars/workstations_windows/vars.yml: created; WinRM connection vars
  (ansible_user/password resolved per-host)
- host_vars/morgoth.prole.org.yml: ansible_user=chrisfu + vault ref
- host_vars/fairyland.prole.org.yml: ansible_user=minecraft + vault ref
- windows_ollama_models.yml: fix PowerShell ollama show check — wrap in
  try/catch so ErrorActionPreference=Stop does not abort on model-not-found

Result: mxbai-embed-large-2k (num_ctx=2048) created on both hosts.
Idempotent — re-running only recreates if Modelfile hash changes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible.sh

@@ -4,6 +4,11 @@ set -euo pipefail
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 export ANSIBLE_CONFIG="${ROOT_DIR}/ansible.cfg"
 
+# macOS: prevent Objective-C runtime from aborting forked worker processes.
+# Required for WinRM connections (pywinrm/requests uses Foundation framework
+# internally; macOS kills forked children that load ObjC before fork()).
+export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES
+
 # Defaults
 MODE="fg"                           # fg|bg
 PLAYBOOK="infrastructure/playbooks/site.yml"

infrastructure/inventory/group_vars/workstations_windows/vars.yml

@@ -0,0 +1,6 @@
+# WinRM connection vars for Windows GPU workstations (morgoth, fairyland).
+# ansible_user and ansible_password are set per-host in host_vars/ because
+# the two machines use different local accounts.
+# Passwords are vaulted in group_vars/all/prole_vault.yml as:
+#   vault_winrm_password_morgoth   (chrisfu@morgoth)
+#   vault_winrm_password_fairyland (minecraft@fairyland)

infrastructure/inventory/host_vars/fairyland.prole.org.yml

@@ -0,0 +1,3 @@
+# WinRM credentials for fairyland.prole.org (Windows GPU workstation)
+ansible_user: minecraft
+ansible_password: "{{ vault_winrm_password_fairyland }}"

infrastructure/inventory/host_vars/morgoth.prole.org.yml

@@ -0,0 +1,3 @@
+# WinRM credentials for morgoth.prole.org (Windows GPU workstation)
+ansible_user: chrisfu
+ansible_password: "{{ vault_winrm_password_morgoth }}"

infrastructure/inventory/hosts.ini

@@ -79,8 +79,8 @@ zinfandel.prole.org ansible_user=chrisfu ansible_ssh_private_key_file=~/.ssh/id_
 # Kerberos via Windows SSPI — no MIT Kerberos client needed.
 # If not joined, add ansible_winrm_transport=kerberos after domain-joining.
 [workstations_windows]
-morgoth.prole.org    ansible_user=chrisfu ansible_connection=winrm ansible_winrm_transport=ntlm ansible_winrm_server_cert_validation=ignore
+morgoth.prole.org    ansible_connection=winrm ansible_winrm_transport=ntlm ansible_winrm_server_cert_validation=ignore ansible_winrm_scheme=http ansible_port=5985
-fairyland.prole.org  ansible_user=chrisfu ansible_connection=winrm ansible_winrm_transport=ntlm ansible_winrm_server_cert_validation=ignore
+fairyland.prole.org  ansible_connection=winrm ansible_winrm_transport=ntlm ansible_winrm_server_cert_validation=ignore ansible_winrm_scheme=http ansible_port=5985
 
 [workstations_windows:vars]
 ansible_become=false

infrastructure/playbooks/windows_ollama_models.yml

@@ -122,8 +122,15 @@
           ''
         }
 
-        & $ollama show $modelName *> $null
+        # Check model existence without letting $ErrorActionPreference = Stop
-        $modelExists = ($LASTEXITCODE -eq 0)
+        # treat a non-zero exit code as a terminating error.
+        $modelExists = $false
+        try {
+          $null = & $ollama show $modelName 2>&1
+          $modelExists = ($LASTEXITCODE -eq 0)
+        } catch {
+          $modelExists = $false
+        }
 
         if ($modelExists -and ($recordedHash -eq $desiredHash)) {
           Write-Output "unchanged: $modelName already matches managed Modelfile"