feat(ansible): add linux-baseline role and day0_linux_baseline playbook

Introduces a single, idempotent baseline role to supersede the
overlapping day0-baseline and common roles. Capabilities are
feature-flagged so they can be toggled per-host:

  - packages (common + OS-family + per-host extras)
  - timezone + locale
  - chrony time sync against sundial
  - baseline users (jarvis admin account with SSH key + NOPASSWD sudo)
  - SSH hardening via /etc/ssh/sshd_config.d/ drop-in
  - unattended security upgrades (Debian family)
  - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf
  - journald retention caps
  - branded MOTD

Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder
for future distros via the ansible_os_family pattern.

The legacy day0-baseline and common roles remain in place for now and
will be removed during the playbook cleanup sweep, alongside the
existing playbook naming inconsistencies.

ansible/roles/linux-baseline/tasks/main.yml

@@ -0,0 +1,63 @@
+---
+# ============================================================================
+# linux-baseline / main entrypoint
+# ============================================================================
+# Orchestrates baseline application. Each capability sits behind a
+# feature flag in baseline_features so individual concerns can be
+# disabled per-host without forking the role.
+# ============================================================================
+
+- name: Preflight checks
+  ansible.builtin.import_tasks: preflight.yml
+  tags: [baseline, preflight, always]
+
+- name: Load OS-family-specific variables
+  ansible.builtin.include_vars: "{{ ansible_os_family }}.yml"
+  tags: [baseline, always]
+
+- name: Apply package baseline
+  ansible.builtin.import_tasks: packages.yml
+  when: baseline_features.packages | bool
+  tags: [baseline, packages]
+
+- name: Configure timezone and locale
+  ansible.builtin.import_tasks: timezone.yml
+  when: baseline_features.timezone | bool
+  tags: [baseline, timezone]
+
+- name: Configure time synchronisation
+  ansible.builtin.import_tasks: time_sync.yml
+  when: baseline_features.time_sync | bool
+  tags: [baseline, time-sync]
+
+- name: Provision baseline users
+  ansible.builtin.import_tasks: users.yml
+  when: baseline_features.users | bool
+  tags: [baseline, users]
+
+- name: Harden SSH
+  ansible.builtin.import_tasks: ssh_hardening.yml
+  when: baseline_features.ssh_hardening | bool
+  tags: [baseline, ssh, hardening]
+
+- name: Configure unattended security upgrades
+  ansible.builtin.import_tasks: unattended_upgrades.yml
+  when:
+    - baseline_features.unattended_upgrades | bool
+    - ansible_os_family == "Debian"
+  tags: [baseline, unattended-upgrades]
+
+- name: Apply sysctl baseline
+  ansible.builtin.import_tasks: sysctl.yml
+  when: baseline_features.sysctl | bool
+  tags: [baseline, sysctl]
+
+- name: Configure journald retention
+  ansible.builtin.import_tasks: journald.yml
+  when: baseline_features.journald | bool
+  tags: [baseline, journald]
+
+- name: Apply MOTD branding
+  ansible.builtin.import_tasks: motd.yml
+  when: baseline_features.motd | bool
+  tags: [baseline, motd]