Stop mislabeling the Compose box as production in read-only audits

.github/workflows/audit-qdrant-corpus.yml

@@ -1,13 +1,15 @@
-name: Audit production Qdrant corpus (read-only)
+name: Audit Compose rollback Qdrant corpus (read-only)
 
-# Answers "is the practice corpus the same corpus production serves?" with
+# `realvuxbaro.me` has run on k3s since the 2026-08-17 cutover; this workflow
+# still SSHes into secrets.EC2_HOST, which is the retired Compose EC2 kept
+# only as a manual DNS fallback. It fingerprints that box's Qdrant with
 # content hashes rather than a point count, which two different corpora can
-# share. The identical script runs against the k3s cluster over SSH, so the
-# two fingerprints are directly comparable.
+# share — the same script can be run against the k3s side (over SSH, or via
+# `docker exec` on its ai-service pod) to check the fallback still matches
+# real production before ever relying on it.
 #
-# Read-only: it scrolls points and reads collection info. It changes nothing on
-# production, and its path is not in deploy.yml's filters, so merging it cannot
-# restart the Compose stack.
+# Read-only: it scrolls points and reads collection info. It changes nothing,
+# on this box or any other, and cannot trigger a rebuild of it.
 
 on:
   workflow_dispatch:
@@ -30,7 +32,7 @@ jobs:
       - name: Encode fingerprint script
         run: echo "SCRIPT_B64=$(base64 -w0 scripts/qdrant_fingerprint.py)" >> "$GITHUB_ENV"
 
-      - name: Fingerprint production corpus over SSH
+      - name: Fingerprint the Compose rollback corpus over SSH
         uses: appleboy/ssh-action@v1.0.3
         env:
           SCRIPT_B64: ${{ env.SCRIPT_B64 }}