fix(inventory): keep vault tags when provisioning the tor node

apply_tor_node_onion rewrote host_vars through utils.cache.yaml, whose
!vault constructor returns a plain string and, depending on import order,
wins over the VaultScalar constructor of utils.handler.vault. Provision
calls it after generating credentials, so with svc-net-tor in the include
every credential lost its tag and Ansible rendered the raw ciphertext:
redis got --requirepass '$ANSIBLE_VAULT...', compose cut env values to
";1.1;AES256" and the openldap ldapsm bind failed with result 49.

Write through the round-trip helpers like every other writer in the
package. test_preserves_existing_vault_credentials passes again.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

cli/administration/inventory/provision/tor_node.py

@@ -14,7 +14,7 @@ from typing import TYPE_CHECKING
 
 from cli.administration.inventory.onion import ensure_node_onion
 
-from .yaml_io import dump_yaml, load_yaml
+from .ruamel_io import dump_document, ensure_map, load_document
 
 if TYPE_CHECKING:
     from pathlib import Path
@@ -33,12 +33,8 @@ def apply_tor_node_onion(
     if _PROVIDER not in application_ids:
         return
     address = ensure_node_onion(base_dir)
-    data = load_yaml(host_vars_file) if host_vars_file.exists() else {}
-    if not isinstance(data, dict):
-        data = {}
-    apps = data.setdefault("applications", {})
-    svc = apps.setdefault(_PROVIDER, {})
-    services = svc.setdefault("services", {})
-    tor = services.setdefault("tor", {})
-    tor["node"] = address
-    dump_yaml(host_vars_file, data)
+    document = load_document(host_vars_file)
+    apps = ensure_map(document, "applications")
+    services = ensure_map(ensure_map(apps, _PROVIDER), "services")
+    ensure_map(services, "tor")["node"] = address
+    dump_document(host_vars_file, document)