Fix P1 WEBRUNNER deployment failures and secret leakage

- providers/webrunner.yml: wrap loop_var under loop_control in all three
  provider provision tasks — Ansible was rejecting loop_var as a conflicting
  action statement alongside include_tasks
- deployment_engine.py: strip _SECRET_KEYS (tokens, passwords, api keys)
  from create_extra_vars() — credentials are already set as env vars by
  set_provider_environment(), no need to pass them through --extra-vars
  where they end up in process listings and logs
- deployment_engine.py: remove debug log line that dumped the full
  ansible-playbook command including all extra-vars JSON with live creds
- deployment_engine.py: create deployment log files with 0o600 permissions
  instead of world-readable 0o644
- deploy_webrunner.py: remove load_vars_file() call that was pulling
  phishing module creds (SMTP password, gophish port, domain) into the
  webrunner config dict — all provider creds already collected by
  gather_provider_config()
- deploy_webrunner.py: remove unused select_provider import
- .gitignore: narrow 'deployment*' glob to specific artifact patterns so
  deployment_engine.py is no longer excluded from tracking

modules/webrunner/deploy_webrunner.py

@@ -17,9 +17,8 @@ if _base not in sys.path:
 from utils.common import (
     COLORS, clear_screen, print_banner, generate_deployment_id,
     setup_logging, get_public_ip, confirm_action, wait_for_input,
-    load_vars_file,
 )
-from utils.provider_utils import select_provider, gather_provider_config
+from utils.provider_utils import gather_provider_config
 from utils.ssh_utils import generate_ssh_key
 from utils.naming_utils import show_naming_relationship
 from utils.deployment_engine import execute_playbook, set_provider_environment
@@ -353,12 +352,6 @@ def gather_webrunner_parameters() -> dict | None:
     else:
         print(f"{COLORS['CYAN']}  Nodes will remain running after scan — remember to teardown manually.{COLORS['RESET']}")
 
-    # Merge any provider vars not already set
-    for provider in providers:
-        vars_data = load_vars_file(provider)
-        if vars_data:
-            config.update({k: v for k, v in vars_data.items() if k not in config})
-
     # Apply per-provider instance defaults if not set by gather_provider_config
     if 'linode_instance_type' not in config:
         config['linode_instance_type'] = DEFAULT_INSTANCE.get('linode', 'g6-standard-2')