ci: configure and stabilize CI/CD pipeline

- fix runner configuration issues
- correct workflow labels and execution environment
- resolve dependency issues in pipeline (python deps)
- improve reliability of automation runs

observability-stack/docs/architecture.md

@@ -0,0 +1,30 @@
+# Observability Stack Architecture
+
+## Components
+
+- Filebeat: tails sample and container logs.
+- Logstash: receives and processes log events.
+- Elasticsearch: stores searchable observability data.
+- Kibana: supports log exploration and dashboards.
+- Grafana: provides operational dashboards.
+- Alert rules: document symptoms, thresholds, and severity.
+- Incident simulation: generates controlled failure signals.
+
+## Data Flow
+
+```
+Log source -> Filebeat -> Logstash -> Elasticsearch -> Kibana
+                                            |
+                                            v
+                                         Grafana
+```
+
+Incident exercises follow this flow:
+
+```
+Operator -> incident_simulation.sh -> logs/incident_simulation.log -> Filebeat -> Logstash -> alerts/dashboards
+```
+
+## Notes
+
+This is a local demonstration stack, not a production Elasticsearch deployment. A production version would add dedicated nodes, TLS, secret management, retention policies, index lifecycle management, and external alert delivery.