feat(semaphore): install Ansible collections via bind-mounted host directory

- New tasks/collections.yml installs collections from defaults list
  into /opt/semaphore/ansible-collections on the host
- semaphore.container.j2: bind-mounts that dir into the container at
  /home/semaphore/.ansible/collections (read-only)
- defaults/main.yml: semaphore_collections_dir + semaphore_ansible_collections
  list (containers.podman, effectivelywild.technitium_dns)
- main.yml: collections task wired in after semaphore.yml, before verify
- Collections survive container restarts/rebuilds without image changes
- Re-run with --tags collections to add new collections without full redeploy

ansible/roles/semaphore/templates/semaphore.container.j2

@@ -17,6 +17,11 @@ PublishPort={{ semaphore_listen_address }}:{{ semaphore_listen_port }}:3000
 # Persistent runtime state (project repos, tmp playbooks, etc.)
 Volume={{ semaphore_data_volume }}:/var/lib/semaphore:Z
 
+# Ansible collections — host-side dir populated by the semaphore role.
+# Bind-mounted so collections persist across container restarts/rebuilds
+# without baking them into the image.
+Volume={{ semaphore_collections_dir }}:/home/semaphore/.ansible/collections:Z,ro
+
 # Database — points at the postgres container on the user-defined network
 Environment=SEMAPHORE_DB_DIALECT=postgres
 Environment=SEMAPHORE_DB_HOST={{ semaphore_postgres_container_name }}