feat(semaphore): rewrite role with rootful Podman Quadlet + PostgreSQL

Complete rewrite of the semaphore role. Supersedes three prior
iterations whose admin-user-creation logic was unreliable across
Semaphore CLI versions.

Architecture:
  - Rootful Podman Quadlet under /etc/containers/systemd/
  - Separate PostgreSQL 16-alpine container on a user-defined
    podman network (semaphore-net)
  - Named volumes for both data stores (semaphore_data,
    semaphore_postgres_data) so container recreation is
    non-destructive
  - Pinned image tags: semaphoreui/semaphore:v2.18.5-ansible2.16.5
    and postgres:16-alpine
  - Post-deploy HTTP health check fails the playbook if Semaphore
    doesn't respond on /api/ping within ~60s

Admin user creation remains intentionally manual after first deploy;
the role README documents the exact podman exec command.

Removes the duplicate deploy_semaphore.yml and the now-unneeded
cleanup_semaphore.yml; day1_deploy_semaphore.yml is the canonical
entry point.

ansible/playbooks/cleanup_semaphore.yml

@@ -1,56 +0,0 @@
----
-- name: Cleanup old Semaphore deployment on figment
-  hosts: semaphore_server
-  become: true
-  vars_files:
-    - ../roles/semaphore/defaults/main.yml
-  vars:
-    # Set to true to also remove data directories and config
-    semaphore_force_clean: false
-
-  tasks:
-    - name: Stop and remove old Semaphore container
-      containers.podman.podman_container:
-        name: "{{ semaphore_container_name }}"
-        state: absent
-      ignore_errors: true
-
-    - name: Stop and disable legacy generated systemd service
-      ansible.builtin.systemd:
-        name: "container-{{ semaphore_container_name }}.service"
-        state: stopped
-        enabled: false
-      ignore_errors: true
-
-    - name: Remove legacy systemd unit file
-      ansible.builtin.file:
-        path: "/etc/systemd/system/container-{{ semaphore_container_name }}.service"
-        state: absent
-
-    - name: Remove quadlet files (if any were previously deployed)
-      ansible.builtin.file:
-        path: "/etc/containers/systemd/{{ item }}.container"
-        state: absent
-      loop:
-        - "{{ semaphore_container_name }}"
-        - "{{ semaphore_postgres_container_name }}"
-
-    - name: Reload systemd daemon
-      ansible.builtin.systemd:
-        daemon_reload: true
-
-    - name: Remove data directories (only when semaphore_force_clean=true)
-      when: semaphore_force_clean | bool
-      ansible.builtin.file:
-        path: "{{ item }}"
-        state: absent
-      loop:
-        - "{{ semaphore_data_dir }}"
-        - "{{ semaphore_config_dir }}"
-
-    - name: Remove PostgreSQL data volume marker (only when semaphore_force_clean=true)
-      when: semaphore_force_clean | bool and semaphore_use_postgres | default(false)
-      ansible.builtin.file:
-        path: "/var/lib/containers/storage/volumes/{{ semaphore_postgres_volume }}/_data"
-        state: absent
-      ignore_errors: true

ansible/playbooks/day1_deploy_semaphore.yml

@@ -1,22 +1,17 @@
 ---
-# ------------------------------------------------------------------------------
-# FILE: playbooks/day1_deploy_semaphore.yml
-# DESCRIPTION: Deploys Semaphore on imagineering
-#              Runs: common → docker-host → semaphore
+# ============================================================================
+# day1_deploy_semaphore.yml
+# ----------------------------------------------------------------------------
+# Deploys SemaphoreUI + PostgreSQL on the imagineering host (figment).
+# Run AFTER day0_linux_baseline.yml has been applied to the target.
 #
-# USAGE:
+# Usage:
 #   ansible-playbook -i inventory.yml playbooks/day1_deploy_semaphore.yml
-#
-# SECRETS REQUIRED IN VAULT (group_vars/all/vault):
-#   vault_semaphore_database_password
-#   vault_semaphore_admin_password
-#   vault_semaphore_access_key_encryption
-# ------------------------------------------------------------------------------
+# ============================================================================
 
-- name: Deploy Semaphore
+- name: Deploy SemaphoreUI on imagineering
   hosts: semaphore_server
   become: true
-
+  gather_facts: true
   roles:
-    - docker-host
     - semaphore

ansible/playbooks/deploy_semaphore.yml

@@ -1,10 +0,0 @@
----
-# Cleanup old deployments first with:
-#   ansible-playbook -i inventory.yml playbooks/cleanup_semaphore.yml --limit figment
-#   (add -e "semaphore_force_clean=true" to also remove data)
-
-- name: Deploy Semaphore on figment
-  hosts: figment
-  become: true
-  roles:
-    - semaphore