fix(cleanup,config): xen tmp cleanup, tpm2 fallback warning, add code comments

roles/configuration/tasks/encryption/tpm2.yml

@@ -80,10 +80,11 @@
           host stderr={{ configuration_luks_tpm2_enroll_host.stderr | default('') }}
   rescue:
     - name: Warn about TPM2 enrollment failure
-      ansible.builtin.debug:
+      ansible.builtin.fail:
         msg: >-
-          TPM2 enrollment failed — falling back to keyfile auto-decrypt.
+          WARNING: TPM2 enrollment failed — falling back to keyfile auto-decrypt.
           The system will use a keyfile instead of TPM2 for automatic LUKS unlock.
+      ignore_errors: true
 
     - name: Fallback to keyfile auto-decrypt
       ansible.builtin.set_fact: