feat(ansible): add linux-baseline role and day0_linux_baseline playbook

Introduces a single, idempotent baseline role to supersede the
overlapping day0-baseline and common roles. Capabilities are
feature-flagged so they can be toggled per-host:

  - packages (common + OS-family + per-host extras)
  - timezone + locale
  - chrony time sync against sundial
  - baseline users (jarvis admin account with SSH key + NOPASSWD sudo)
  - SSH hardening via /etc/ssh/sshd_config.d/ drop-in
  - unattended security upgrades (Debian family)
  - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf
  - journald retention caps
  - branded MOTD

Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder
for future distros via the ansible_os_family pattern.

The legacy day0-baseline and common roles remain in place for now and
will be removed during the playbook cleanup sweep, alongside the
existing playbook naming inconsistencies.

ansible/group_vars/all/vars

@@ -19,6 +19,15 @@ terraform_server: "infra01"
 # Traefik variables
 traefik_server: "lightning-lane"
 
+# ---------------------------------------------------------------------------
+# JARVIS automation account
+# ---------------------------------------------------------------------------
+# Public key for the 'jarvis' user provisioned by the linux-baseline role on
+# every host. Public keys are not secret; the matching private key lives on
+# the JARVIS command centre (carousel-of-progress) and, when needed, in
+# group_vars/all/vault as vault_jarvis_ssh_private_key.
+jarvis_ssh_public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID5sym5ajFvDyzw395BkHv7qVb66XPTx/OF1p19MGuNo jarvis@mk-labs"
+
 step_ca_principal_mappings:
   - local_user: wed
     principals: