docs(bootstrap): add section comments, role boundary docs, and pipeline overview

main.yml

@@ -1,4 +1,14 @@
 ---
+# Bootstrap pipeline — role execution order:
+#   1. global_defaults  — normalize + validate system/hypervisor/disk input
+#   2. system_check     — pre-flight hardware/environment safety checks
+#   3. virtualization   — create VM on hypervisor (libvirt/proxmox/vmware/xen)
+#   4. environment      — detect live ISO, configure installer network, install tools
+#   5. partitioning     — partition disk, create FS, LUKS, LVM, mount everything
+#   6. bootstrap        — debootstrap/pacstrap/dnf install the target OS into /mnt
+#   7. configuration    — users, network, encryption, fstab, bootloader, services
+#   8. cis              — CIS hardening (optional, per system.features.cis.enabled)
+#   9. cleanup          — unmount, remove cloud-init artifacts, reboot/shutdown
 - name: Create and configure VMs
   hosts: "{{ bootstrap_target | default('all') }}"
   strategy: free # noqa: run-once[play]