feat: proof of concept - optional sub-deploy feature

Umbrella: #198
Wave: WAVE_04 (since 2026-06-05)
Cross-repo: range42/range42-playbooks#69

What

A scenario can now declare optional components in manifest/feature_flags.yml. At deploy time the operator opts in/out of each component, and the import_playbook blocks that wire those components are gated by when: enable_<id> | default(<bool>) | bool. No scenario-side change is needed beyond the YAML catalog and the when: clauses.

The toggles surface in two equivalent ways :

1. CLI passthrough on range42-context deploy and range42-context deploy-vms :

   range42-context deploy      -e enable_wazuh=false   # full deploy without wazuh
   range42-context deploy-vms  -e enable_wazuh=false   # VMs-only redeploy without wazuh

2. Interactive checkboxes via the TUI :

   range42-context --tui  ->  select "deploy" (or "deploy-vms")
                          ->  DeployOptionsScreen modal renders one checkbox per feature
                          ->  untick to skip, Enter to launch
   

The TUI reads the same manifest/feature_flags.yml to populate the modal, so a feature added to the YAML appears automatically in the TUI on next launch.

POC scope

This PR wires the mechanism end-to-end with wazuh on demo_lab as the first opt-in service. The full deploy / VMs-only deploy / reset paths all support the override.

Other services will follow the same pattern in subsequent cycles (misp, gitea, rocketchat, mattermost, nextcloud, ...). Each will land as a 2-line change in the playbook (when: enable_<id>) plus a row added to manifest/feature_flags.yml. No further code changes in the TUI or the shell helpers.

Files (cross-repo)

range42 (this repo) :

• range42-context-tui.py - new DeployOptionsScreen + arg_ui="deploy-options" on deploy and deploy-vms + helper that reads the active scenario's manifest/feature_flags.yml
• roles/deployer.bootstrap/files/range42-context.sh - _r42_deploy and _r42_deploy_vms propagate "$@" ; dispatcher passes "$@" to both
• range42-init.py - warmup install extended with pyyaml (used by the TUI to parse the YAML catalog)

range42-playbooks :

• scenarios/demo_lab/manifest/feature_flags.yml - new declarative catalog (sibling of scenario_vms.json)
• scenarios/demo_lab/02_admin_infrastructure/_main.yml - when: enable_wazuh | default(true) | bool on the 2 mon_wazuh.yml imports
• scenarios/demo_lab/demo_lab.setup.sh - "$@" propagation to ansible-playbook
• scenarios/demo_lab/demo_lab.setup_vms_only.sh - idem
• scenarios/demo_lab/demo_lab.reset.setup.sh - idem
• scenarios/demo_lab/README.md - short note on the optional components mechanism

References

• Umbrella : tracking: WAVE_04 integration testing in dev #198
• Cross-repo umbrella : tracking: WAVE_04 integration testing in dev range42-playbooks#69