feat(ansible): add linux-baseline role and day0_linux_baseline playbook

Introduces a single, idempotent baseline role to supersede the
overlapping day0-baseline and common roles. Capabilities are
feature-flagged so they can be toggled per-host:

  - packages (common + OS-family + per-host extras)
  - timezone + locale
  - chrony time sync against sundial
  - baseline users (jarvis admin account with SSH key + NOPASSWD sudo)
  - SSH hardening via /etc/ssh/sshd_config.d/ drop-in
  - unattended security upgrades (Debian family)
  - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf
  - journald retention caps
  - branded MOTD

Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder
for future distros via the ansible_os_family pattern.

The legacy day0-baseline and common roles remain in place for now and
will be removed during the playbook cleanup sweep, alongside the
existing playbook naming inconsistencies.

ansible/roles/linux-baseline/README.md

@@ -0,0 +1,64 @@
+# linux-baseline
+
+Idempotent baseline for any Linux host in mk-labs.
+
+## What it does
+
+Applied on every host, this role guarantees a known-good operational baseline:
+
+| Capability           | Default | Description                                                   |
+|----------------------|---------|---------------------------------------------------------------|
+| `packages`           | on      | Installs curated common + OS-family packages, plus host extras |
+| `timezone`           | on      | Sets timezone and locale                                       |
+| `time_sync`          | on      | Installs and configures chrony against `sundial`               |
+| `users`              | on      | Provisions baseline admin accounts (jarvis) with SSH + sudo    |
+| `ssh_hardening`      | on      | Deploys `/etc/ssh/sshd_config.d/10-mk-labs-hardening.conf`     |
+| `unattended_upgrades`| on      | Security-only automatic upgrades on Debian-family hosts        |
+| `sysctl`             | on      | Drop-in at `/etc/sysctl.d/99-mk-labs.conf`                     |
+| `journald`           | on      | Caps journal size + retention                                  |
+| `motd`               | on      | Branded MOTD                                                   |
+| `full_upgrade`       | off     | Opt-in full dist-upgrade. Use the day2 update playbook instead |
+
+Every capability sits behind a feature flag in `baseline_features` so it
+can be disabled per-host without forking the role.
+
+## OS support
+
+- **First-class:** Ubuntu (22.04, 24.04) and Debian (bullseye, bookworm).
+- **Placeholder:** RHEL family — see `vars/RedHat.yml`. Flesh out when a
+  RHEL-family host joins the fleet.
+
+OS-specific values are loaded from `vars/{{ ansible_os_family }}.yml`.
+
+## Required inventory variables
+
+| Variable                | Where           | Example                                   |
+|-------------------------|-----------------|-------------------------------------------|
+| `jarvis_ssh_public_key` | group_vars/all  | `ssh-ed25519 AAAA... jarvis@mk-labs`      |
+
+## Usage
+
+```yaml
+- name: Apply linux-baseline
+  hosts: "{{ target | default('all') }}"
+  become: true
+  roles:
+    - linux-baseline
+```
+
+## Per-host overrides
+
+```yaml
+# host_vars/some-host/vars
+baseline_packages_extra:
+  - postgresql-client
+  - redis-tools
+
+baseline_features:
+  motd: false
+```
+
+## Migration notes
+
+This role supersedes the legacy `day0-baseline` and `common` roles, both
+of which are slated for removal once the fleet has been re-baselined.