upgrade-guide: manager update for seed-container deploys

[ideaship]

What

Give upgrade-guide/manager.mdx a seed-container update story. The seed
container is now a documented (and default) deploy path, which can leave a
manager with no local Ansible venv — but the manager update step assumed the
self-bootstrapped manager and gave no guidance otherwise.

Commits (one concern each)

• upgrade-guide: fix vault note for manager update — Corrects the step-3 note:
  the ">= 8.0.0 --ask-vault-pass no longer necessary" relief is the osism apply
  / worker path. osism update manager runs out-of-band (it recreates the manager
  containers) and cannot use the Redis-stored worker vault password, so the
  password must be supplied directly whenever secrets.yml is encrypted.
• upgrade-guide: map manager update to deploy topology — Adds an admonition
  naming the same osism.manager.manager playbook behind every update and
  selecting the launcher by topology: osism update manager on a manager with a
  local venv, or re-run ./run.sh manager from a still-available seed node.
• upgrade-guide: document seed-container manager update — Adds the third row: a
  manager deployed with the seed container and separated from its seed (no venv)
  updates with ./run.sh manager from the configuration repository on the manager
  itself. run.sh ships in the repo and is refreshed by make sync, so it runs
  the update inside the osism/seed container (SEED_CONTAINER=auto) independent
  of the manager's installed tooling.

Merge order

All three commits are accurate on current main and can land independently — the
seed-container row uses run.sh, which is already released, so the upgrade does
not depend on any unreleased change. Bringing the osism-update-manager wrapper
to seed-container parity, so osism update manager works as a drop-in alias for
run.sh, is a separate and non-blocking improvement:

• manager: wire update-manager seed-container path ansible-collection-services#2125

🤖 Generated with Claude Code

[github-actions]

✅⚠️MegaLinter analysis: Success with warnings

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	5		0	0	0.03s
✅ JSON	jsonlint	4		0	0	0.12s
✅ JSON	prettier	4		0	0	0.44s
✅ JSON	v8r	4		0	0	10.17s
✅ MARKDOWN	markdownlint	160		0	0	2.57s
✅ MARKDOWN	markdown-table-formatter	160		0	0	0.37s
✅ REPOSITORY	checkov	yes		no	no	19.92s
✅ REPOSITORY	git_diff	yes		no	no	0.04s
✅ REPOSITORY	secretlint	yes		no	no	1.77s
✅ REPOSITORY	trufflehog	yes		no	no	4.2s
✅ SPELL	codespell	170		0	0	0.63s
⚠️ SPELL	lychee	170		3	0	22.46s
✅ YAML	prettier	6		0	0	0.33s
✅ YAML	v8r	6		0	0	6.51s
✅ YAML	yamllint	6		0	0	0.43s

Detailed Issues

⚠️ SPELL / lychee - 3 errors

📝 Summary
---------------------
🔍 Total..........923
🔗 Unique.........746
✅ Successful.....850
⏳ Timeouts.........9
🔀 Redirected......46
👻 Excluded........61
❓ Unknown..........0
🚫 Errors...........3
⛔ Unsupported......3

Errors in docs/appendix/security/ossa-2026-001.md
[TIMEOUT] https://bugs.launchpad.net/keystonemiddleware/+bug/2129018 (at 124:3) | Request timed out

Errors in docs/appendix/security/ossa-2026-002.md
[TIMEOUT] https://bugs.launchpad.net/nova/+bug/2137507 (at 111:3) | Request timed out

Errors in docs/appendix/security/ossa-2026-015.md
[TIMEOUT] https://bugs.launchpad.net/keystone/+bug/2148398 (at 174:3) | Request timed out
[TIMEOUT] https://bugs.launchpad.net/keystone/+bug/2148477 (at 175:3) | Request timed out
[TIMEOUT] https://bugs.launchpad.net/keystone/+bug/2149789 (at 177:3) | Request timed out
[TIMEOUT] https://bugs.launchpad.net/keystone/+bug/2150089 (at 178:3) | Request timed out
[TIMEOUT] https://bugs.launchpad.net/keystone/+bug/2150379 (at 179:3) | Request timed out

Errors in docs/appendix/security/ossa-2026-022.md
[TIMEOUT] https://bugs.launchpad.net/nova/+bug/2151252 (at 145:3) | Request timed out

Errors in docs/guides/user-guide/openstack/migration-vmware-esxi.md
[ERROR] https://www.openstack.org/vmware-migration-to-openstack (at 20:1) | Connection failed. Check network connectivity and firewall settings

Errors in docs/release-notes/index.md
[ERROR] https://release.osism.tech/ (at 11:1) | Connection failed. Check network connectivity and firewall settings

Errors in docs/release-notes/osism-7.md
[ERROR] https://www.openstack.org/software/openstack-bobcat (at 977:38) | Connection failed. Check network connectivity and firewall settings

Errors in docs/release-notes/osism-9.md
[TIMEOUT] https://bugs.launchpad.net/kolla/+bug/2111620 (at 96:47) | Request timed out

Hint: Followed 46 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@9.5.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_SECRETLINT,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,SPELL_CODESPELL,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository