feat(semaphore): install Ansible collections via bind-mounted host directory

- New tasks/collections.yml installs collections from defaults list
  into /opt/semaphore/ansible-collections on the host
- semaphore.container.j2: bind-mounts that dir into the container at
  /home/semaphore/.ansible/collections (read-only)
- defaults/main.yml: semaphore_collections_dir + semaphore_ansible_collections
  list (containers.podman, effectivelywild.technitium_dns)
- main.yml: collections task wired in after semaphore.yml, before verify
- Collections survive container restarts/rebuilds without image changes
- Re-run with --tags collections to add new collections without full redeploy

ansible/roles/semaphore/tasks/collections.yml

@@ -0,0 +1,30 @@
+---
+# ============================================================================
+# Install Ansible collections into a host-side directory that is
+# bind-mounted into the Semaphore container at the Ansible collections
+# path (/home/semaphore/.ansible/collections).
+#
+# This persists collections across container restarts/rebuilds without
+# baking them into the image. Add new collections to
+# semaphore_ansible_collections in defaults/main.yml.
+# ============================================================================
+
+- name: Ensure Ansible collections directory exists on host
+  ansible.builtin.file:
+    path: "{{ semaphore_collections_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Install Ansible collections into host collections directory
+  ansible.builtin.command:
+    cmd: >
+      ansible-galaxy collection install
+      {{ item.name }}{% if item.version is defined %}:{{ item.version }}{% endif %}
+      -p {{ semaphore_collections_dir }}
+      --force
+  loop: "{{ semaphore_ansible_collections }}"
+  loop_control:
+    label: "{{ item.name }}"
+  changed_when: true

ansible/roles/semaphore/tasks/main.yml

@@ -31,6 +31,10 @@
   ansible.builtin.import_tasks: semaphore.yml
   tags: [semaphore]
 
+- name: Install Ansible collections for Semaphore
+  ansible.builtin.import_tasks: collections.yml
+  tags: [semaphore, collections]
+
 - name: Verify Semaphore is reachable
   ansible.builtin.import_tasks: verify.yml
   tags: [semaphore, verify]