ha: VAULT1 CIFS mount monitor; runbooks: supervisor root-cause

HA: add binary_sensor.vault1_cifs_mounted (grep /proc/mounts every 5 min),
rest_command.vault1_push_heartbeat, and two automations — heartbeat push to
Uptime Kuma push monitor (id=45, 10-min timeout) and direct ntfy alert if
CIFS drops for >3 min. Catches the sda8-fallthrough scenario in <8 min.

Runbooks: root cause of credential file loss is NOT unclean shutdown but
the HAOS 17.3 supervisor (2026.05.x) deleting the cred file during mount
reload cycles. Exact moment: 2026-05-22 00:53:31 UTC, 13 min after the
HAOS 17.3 first-boot successful mount. NUT gap documented (HAOS not a NUT
slave); recommended to add Community NUT addon targeting cyberpower1@.200.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ha/automations.yaml

@@ -46,3 +46,35 @@
         Hard-refresh your browser: Ctrl+Shift+R (Win/Linux) or Cmd+Shift+R (Mac) to clear frontend cache.
       priority: high
       tags: warning,house
+
+- id: vault1_mount_heartbeat
+  alias: VAULT1 Mount – Push Heartbeat
+  description: "Every 5 min: if VAULT1 is CIFS-mounted, push heartbeat to Uptime Kuma. Missed heartbeats alert via ntfy."
+  triggers:
+  - platform: time_pattern
+    minutes: "/5"
+  conditions:
+  - condition: state
+    entity_id: binary_sensor.vault1_cifs_mounted
+    state: "on"
+  actions:
+  - action: rest_command.vault1_push_heartbeat
+
+- id: vault1_mount_lost_alert
+  alias: VAULT1 Mount – Alert on CIFS Lost
+  description: "Alert via ntfy if VAULT1 stops being CIFS-mounted (fallthrough to sda8 scenario)."
+  triggers:
+  - platform: state
+    entity_id: binary_sensor.vault1_cifs_mounted
+    to: "off"
+    for: "00:03:00"
+  actions:
+  - action: rest_command.ntfy_grafana_alerts
+    data:
+      title: "VAULT1 CIFS Lost – Frigate writing to sda8"
+      message: >-
+        /media/VAULT1 is no longer CIFS-mounted (//172.30.32.1/VAULT1 dropped).
+        Frigate recordings are going to sda8 (system partition) until fixed.
+        See RB-001 in runbooks/phase5-incident-log.md for recovery steps.
+      priority: high
+      tags: warning,house