multica_agent_host: merge declared keys into the daemon user's Claude settings (WDWL-22)

The npm-installed Claude Code on spaceship-earth updated itself from the
pinned 2.1.304 to 2.1.308 right after its first login, so every play would
downgrade it and it would update again. New multica_claude_settings is
merged (recursively, not templated, since Claude writes the file too) into
~multica/.claude/settings.json.

provision-agent-host.yml sets DISABLE_AUTOUPDATER=1 and mirrors the model
mix already live on haunted-mansion: model sonnet, subagents haiku,
MAX_THINKING_TOKENS 4000, BASH_MAX_OUTPUT_LENGTH 20000, thinking off.

spaceship-earth: back on 2.1.304 and staying there; second run changed=0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/multica_agent_host/defaults/main.yml

@@ -129,6 +129,15 @@ multica_agent_cli_catalog:
     manual_login: true
     manual_login_hint: "configure Hermes credentials as {{ multica_user }} (Hermes reads 1Password natively; confirm against its docs)"
 
+# Keys MERGED (recursively) into the daemon user's ~/.claude/settings.json.
+# Merged, not templated: Claude Code writes that file itself. Keys not named
+# here are left alone. Empty = don't touch the file.
+#
+# An npm-installed Claude Code updates itself in place, which silently breaks
+# the package_version pin above (and the next play downgrades it again).
+# Setting env.DISABLE_AUTOUPDATER: "1" here is what makes the pin hold.
+multica_claude_settings: {}
+
 # -----------------------------------------------------------------------------
 # Node.js (installed only when a selected agent CLI needs npm)
 # -----------------------------------------------------------------------------

ansible/roles/multica_agent_host/tasks/claude_settings.yml

@@ -0,0 +1,34 @@
+---
+- name: Claude settings | Ensure ~/.claude exists
+  ansible.builtin.file:
+    path: "{{ multica_user_home }}/.claude"
+    state: directory
+    owner: "{{ multica_user }}"
+    group: "{{ multica_group }}"
+    mode: "0700"
+  become: true
+
+- name: Claude settings | Read the current settings
+  ansible.builtin.slurp:
+    src: "{{ multica_user_home }}/.claude/settings.json"
+  register: _multica_claude_settings_raw
+  failed_when: false
+  become: true
+
+- name: Claude settings | Merge the declared keys over them
+  ansible.builtin.set_fact:
+    _multica_claude_settings_current: >-
+      {{ (_multica_claude_settings_raw.content | b64decode | from_json)
+         if _multica_claude_settings_raw.content is defined else {} }}
+
+- name: Claude settings | Write them back if anything differs
+  ansible.builtin.copy:
+    dest: "{{ multica_user_home }}/.claude/settings.json"
+    content: "{{ _multica_claude_settings_current | combine(multica_claude_settings, recursive=true) | to_nice_json }}\n"
+    owner: "{{ multica_user }}"
+    group: "{{ multica_group }}"
+    mode: "0600"
+  become: true
+  when: >-
+    _multica_claude_settings_current | combine(multica_claude_settings, recursive=true)
+    != _multica_claude_settings_current

ansible/roles/multica_agent_host/tasks/main.yml

@@ -27,6 +27,13 @@
   ansible.builtin.import_tasks: agent_clis.yml
   tags: [multica, multica_agents]
 
+- name: Claude Code settings
+  ansible.builtin.import_tasks: claude_settings.yml
+  when:
+    - "'claude' in multica_agent_clis"
+    - multica_claude_settings | length > 0
+  tags: [multica, multica_agents, multica_claude_settings]
+
 - name: CLI configuration
   ansible.builtin.import_tasks: config.yml
   tags: [multica, multica_config]