docs(ansible): note WSL /mnt/c world-writable config caveat

Running the playbook from /mnt/c in WSL makes Ansible ignore ansible.cfg
(world-writable dir), losing the inventory. Document the fix (copy to WSL
home, or export ANSIBLE_CONFIG) plus the inventory/syntax-check reminders.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

platform-infra/ansible/README.md

@@ -44,6 +44,29 @@ ansible-playbook site.yml             # apply
 Run a single layer with tags: `--tags zfs`, `--tags docker`, `--tags firewall`,
 `--tags ssh`, `--tags base`.
 
+## Running from Windows / WSL
+
+Files on the `/mnt/c` drive mount are world-writable (mode 0777), so Ansible
+**ignores `ansible.cfg`** there (a security measure) — which then loses the
+inventory path and you get "no hosts matched". Two ways around it:
+
+- **Preferred:** copy the repo into your WSL home and run from there, where
+  permissions are normal (also much faster):
+  ```bash
+  cp -r /mnt/c/claude/heleosv2 ~/heleosv2 && cd ~/heleosv2/platform-infra/ansible
+  ```
+- **Or** force the config explicitly (bypasses the world-writable check):
+  ```bash
+  export ANSIBLE_CONFIG=$(pwd)/ansible.cfg
+  ```
+
+Either way, create the inventory first (`cp inventory/hosts.yml.example
+inventory/hosts.yml` and edit it). WSL itself is not a valid target host (no
+spare disk for the ZFS pool); point the inventory at your Ubuntu VM.
+
+Pre-flight without a host: `ansible-playbook --syntax-check site.yml`
+(`--check` is not meaningful on the first run — see Safety notes).
+
 ## Safety notes
 
 - **ZFS is destructive:** the play refuses to create a pool on a disk that