fix(inventory): declare the two variables the matrix aborts on

The deploy validates every inventory key against the names core reads, and
a bare `{{ VAR }}` in a role template is not one of them. Both names had
lost their declaration, so all 100 matrix jobs of a run aborted before they
deployed anything:

    [ERROR] Inventory validation failed. Aborting deployment.
    - 'DESIGN_BASE_COLOR' is not read by the deploy
    - 'PLAYWRIGHT_MAPACHE_PASSWORD' is not read by the deploy

PLAYWRIGHT_MAPACHE_PASSWORD left secrets.credentials in 6144c85978 because a
generated credential rotates between the matrix's two passes, which leaves
pass 2 facing the password pass 1 stored. The inventory owns the value since
then, so the persona role declares the name.

DESIGN_BASE_COLOR carries the per-run base color of a design sync: two sync
scripts inject it, the development inventory expands it into
services.design.colors.base. web-svc-design declares it empty, in defaults/
rather than vars/, because role vars outrank host_vars and would override
the color the inventory sets.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/test-e2e-playwright/defaults/main.yml

@@ -23,6 +23,11 @@
 #   mask the result of the deploy that actually ran.
 # Param test_e2e_playwright_skip_roles: roles excluded from the run.
 # Param test_e2e_playwright_keep: keep the sidecar and cluster after the run.
+# Param PLAYWRIGHT_MAPACHE_PASSWORD: password the provisioning spec sets on the
+#   mapache persona and every consumer spec logs in with. The inventory owns it
+#   rather than `secrets.credentials`, because a generated credential rotates
+#   between the matrix's two passes and pass 2 would then face the password
+#   pass 1 stored.
 # Param VARIANT_INDEX: 0-based matrix-deploy round id, pushed as an extra var by
 #   `cli/administration/deploy/development/deploy.py` when the matrix
 #   orchestrator runs. Defaults to 0 for dev / non-matrix invocations so
@@ -46,4 +51,6 @@ test_e2e_playwright_only_roles: "{{ lookup('deployment').running }}"
 test_e2e_playwright_skip_roles: []
 test_e2e_playwright_keep: false
 
+PLAYWRIGHT_MAPACHE_PASSWORD: ""
+
 VARIANT_INDEX: 0

roles/web-svc-design/defaults/main.yml

@@ -0,0 +1,5 @@
+---
+# Param DESIGN_BASE_COLOR: the base color a development inventory or the `base=`
+#   of a design sync puts into services.design.colors.base for that run. Empty
+#   here so both outrank it; the shipped palette comes from meta/services.yml.
+DESIGN_BASE_COLOR: ""