multica_agent_host: merge declared keys into the daemon user's Claude settings (WDWL-22)

The npm-installed Claude Code on spaceship-earth updated itself from the
pinned 2.1.304 to 2.1.308 right after its first login, so every play would
downgrade it and it would update again. New multica_claude_settings is
merged (recursively, not templated, since Claude writes the file too) into
~multica/.claude/settings.json.

provision-agent-host.yml sets DISABLE_AUTOUPDATER=1 and mirrors the model
mix already live on haunted-mansion: model sonnet, subagents haiku,
MAX_THINKING_TOKENS 4000, BASH_MAX_OUTPUT_LENGTH 20000, thinking off.

spaceship-earth: back on 2.1.304 and staying there; second run changed=0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/multica_agent_host/defaults/main.yml

@@ -129,6 +129,15 @@ multica_agent_cli_catalog:
     manual_login: true
     manual_login_hint: "configure Hermes credentials as {{ multica_user }} (Hermes reads 1Password natively; confirm against its docs)"
 
+# Keys MERGED (recursively) into the daemon user's ~/.claude/settings.json.
+# Merged, not templated: Claude Code writes that file itself. Keys not named
+# here are left alone. Empty = don't touch the file.
+#
+# An npm-installed Claude Code updates itself in place, which silently breaks
+# the package_version pin above (and the next play downgrades it again).
+# Setting env.DISABLE_AUTOUPDATER: "1" here is what makes the pin hold.
+multica_claude_settings: {}
+
 # -----------------------------------------------------------------------------
 # Node.js (installed only when a selected agent CLI needs npm)
 # -----------------------------------------------------------------------------