make falco alerting opt in

ansible/README.md

@@ -76,9 +76,23 @@ profile's routing assumptions and provide a stable control-plane API address.
 The dedicated VM profile defaults to Geneve tunneling. Native routing should
 only be selected when the VM network routes the pod CIDR between nodes.
 
-The playbook does not create Slack or Discord credentials. Those will be added
-through a separate opt-in Ansible secret toggle so ordinary bootstrap remains
-credential-free.
+The playbook does not create Slack or Discord credentials by default. The
+opt-in `falco_alerting` role enables Slack forwarding only when supplied with a
+Vault-protected webhook value.
+
+Store these variables in an Ansible Vault file:
+
+```yaml
+falco_alerting_enabled: true
+falco_slack_webhook_url: https://hooks.slack.com/services/REPLACE/ME
+```
+
+Then run the bootstrap with `--ask-vault-pass -e
+@ansible/vars/falco-alerting.vault.yml`. The role creates the
+`falco-alerting` Secret without logging its value, applies the optional
+Falcosidekick ArgoCD Application, and lets ArgoCD reconcile the deployment. If
+the toggle is false, the role removes the optional Application and related
+resources.
 
 If CoreDNS cannot resolve external names from a nested Docker network, set
 `k3d_dns_servers` to DNS servers reachable from the Flatcar host. Ansible