feat: add SSH-based fallback for kubeadm IP inventory

.gitea/workflows/kubeadm-reset.yml

@@ -103,8 +103,10 @@ jobs:
       - name: Create kubeadm inventory
         env:
           KUBEADM_SSH_USER: ${{ secrets.KUBEADM_SSH_USER }}
+          KUBEADM_SUBNET_PREFIX: ${{ secrets.KUBEADM_SUBNET_PREFIX }}
         run: |
           set -euo pipefail
+          TF_OUTPUT_JSON=""
           for attempt in 1 2 3 4 5 6; do
             echo "Inventory render attempt $attempt/6"
             TF_OUTPUT_JSON="$(terraform -chdir=terraform output -json)"
@@ -118,8 +120,8 @@ jobs:
             fi
           done
 
-          echo "Failed to render kubeadm inventory after retries"
-          exit 1
+          echo "Falling back to SSH-based inventory discovery"
+          printf '%s' "$TF_OUTPUT_JSON" | ./nixos/kubeadm/scripts/discover-inventory-from-ssh.py > nixos/kubeadm/scripts/inventory.env
 
       - name: Run cluster reset
         run: |