[#707] split AWX control plane body of work out of PFVCluster

Framework enforcement layer adopted; check-rules green. Manifest secrets
are placeholders only.
https://projects.knownelement.com/issues/707#note-4537

README.md

@@ -0,0 +1,25 @@
+# KNEL/awx — AWX control plane body of work
+
+AWX (Ansible Tower upstream) is the fleet automation execution layer: it runs
+the playbooks from [KNEL/KNELIAC](https://git.knownelement.com/KNEL/KNELIAC).
+
+Provenance: split out of [KNEL/PFVCluster](https://git.knownelement.com/KNEL/PFVCluster)
+`awx/` on 2026-09-05 as part of the per-domain repo split ([#769](https://projects.knownelement.com/issues/769)).
+
+## Systems of record
+
+| what | where |
+|---|---|
+| Redmine | [#707](https://projects.knownelement.com/issues/707) AWX bootstrap (inventory/projects/RBAC/EE), [#479](https://projects.knownelement.com/issues/479) deploy verification, [#454](https://projects.knownelement.com/issues/454) 100% IaC mandate |
+| Discourse | env map + lane docs: https://community.turnsys.com/t/331 |
+| Instance | https://tsys-awx.knel.net (runs on k3s; see [KNEL/k8s](https://git.knownelement.com/KNEL/k8s)) |
+
+## Layout
+
+- `install-k3s.sh`, `deploy-awx.sh`, `verify-awx.sh` — AWX-on-k3s lifecycle
+- `namespace.yaml`, `awx-instance.yaml` — manifests (passwords are
+  placeholders: real secrets only via ~/.creds refs, never in repo)
+
+## Status
+
+See [STATUS.md](STATUS.md).