fix(semaphore/collections): mount to /opt/ansible-collections, set ANSIBLE_COLLECTIONS_PATHS

/home/semaphore/.ansible/ is owned by root after Podman creates the
bind-mount dir, so ansible-galaxy can't create sibling tmp dirs.
Mount to a neutral /opt/ansible-collections path and point Ansible
at it via ANSIBLE_COLLECTIONS_PATHS env var instead.

ansible/roles/semaphore/tasks/collections.yml

@@ -30,7 +30,7 @@
       podman exec {{ semaphore_container_name }}
       {{ ansible_galaxy_bin.stdout }} collection install
       {{ item.name }}{% if item.version is defined %}:{{ item.version }}{% endif %}
-      -p /home/semaphore/.ansible/collections
+      -p /opt/ansible-collections
       --force
   loop: "{{ semaphore_ansible_collections }}"
   loop_control:

ansible/roles/semaphore/templates/semaphore.container.j2

@@ -18,9 +18,9 @@ PublishPort={{ semaphore_listen_address }}:{{ semaphore_listen_port }}:3000
 Volume={{ semaphore_data_volume }}:/var/lib/semaphore:Z
 
 # Ansible collections — host-side dir populated by the semaphore role.
-# Bind-mounted so collections persist across container restarts/rebuilds
-# without baking them into the image.
-Volume={{ semaphore_collections_dir }}:/home/semaphore/.ansible/collections:Z,ro
+# Bind-mounted to a neutral path; ANSIBLE_COLLECTIONS_PATHS tells
+# ansible-galaxy where to find them without touching ~/.ansible/.
+Volume={{ semaphore_collections_dir }}:/opt/ansible-collections:Z,ro
 
 # Database — points at the postgres container on the user-defined network
 Environment=SEMAPHORE_DB_DIALECT=postgres
@@ -52,6 +52,9 @@ Environment=SEMAPHORE_WEB_ROOT={{ semaphore_web_url }}
 # Timezone matches host baseline
 Environment=TZ=America/Chicago
 
+# Tell Ansible where to find collections installed by the role
+Environment=ANSIBLE_COLLECTIONS_PATHS=/opt/ansible-collections
+
 [Service]
 Restart=always
 TimeoutStartSec=180