feat(ansible): add linux-baseline role and day0_linux_baseline playbook

Introduces a single, idempotent baseline role to supersede the
overlapping day0-baseline and common roles. Capabilities are
feature-flagged so they can be toggled per-host:

  - packages (common + OS-family + per-host extras)
  - timezone + locale
  - chrony time sync against sundial
  - baseline users (jarvis admin account with SSH key + NOPASSWD sudo)
  - SSH hardening via /etc/ssh/sshd_config.d/ drop-in
  - unattended security upgrades (Debian family)
  - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf
  - journald retention caps
  - branded MOTD

Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder
for future distros via the ansible_os_family pattern.

The legacy day0-baseline and common roles remain in place for now and
will be removed during the playbook cleanup sweep, alongside the
existing playbook naming inconsistencies.

ansible/roles/linux-baseline/tasks/ssh_hardening.yml

@@ -0,0 +1,43 @@
+---
+# ============================================================================
+# SSH hardening
+# ============================================================================
+# Delivered as a drop-in under /etc/ssh/sshd_config.d/. The main
+# sshd_config remains untouched so distro upgrades don't conflict and
+# rollback is trivial (delete the drop-in).
+#
+# Some older sshd builds (Ubuntu < 20.04, Debian < 11) do not honour
+# sshd_config.d/. We fall back to lineinfile on those.
+# ============================================================================
+
+- name: Check whether sshd supports the Include directive
+  ansible.builtin.command:
+    cmd: sshd -T
+  register: sshd_test
+  changed_when: false
+  check_mode: false
+
+- name: Determine if /etc/ssh/sshd_config.d/ is honoured
+  ansible.builtin.stat:
+    path: /etc/ssh/sshd_config.d
+  register: sshd_dropin_dir
+
+- name: Ensure /etc/ssh/sshd_config.d exists when honoured
+  ansible.builtin.file:
+    path: /etc/ssh/sshd_config.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when: sshd_dropin_dir.stat.exists
+
+- name: Deploy SSH hardening drop-in
+  ansible.builtin.template:
+    src: sshd_hardening.conf.j2
+    dest: /etc/ssh/sshd_config.d/10-mk-labs-hardening.conf
+    owner: root
+    group: root
+    mode: "0644"
+    validate: "sshd -t -f %s"
+  when: sshd_dropin_dir.stat.exists
+  notify: Restart sshd