feat(ansible): add linux-baseline role and day0_linux_baseline playbook

Introduces a single, idempotent baseline role to supersede the
overlapping day0-baseline and common roles. Capabilities are
feature-flagged so they can be toggled per-host:

  - packages (common + OS-family + per-host extras)
  - timezone + locale
  - chrony time sync against sundial
  - baseline users (jarvis admin account with SSH key + NOPASSWD sudo)
  - SSH hardening via /etc/ssh/sshd_config.d/ drop-in
  - unattended security upgrades (Debian family)
  - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf
  - journald retention caps
  - branded MOTD

Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder
for future distros via the ansible_os_family pattern.

The legacy day0-baseline and common roles remain in place for now and
will be removed during the playbook cleanup sweep, alongside the
existing playbook naming inconsistencies.

ansible/roles/linux-baseline/tasks/unattended_upgrades.yml

@@ -0,0 +1,37 @@
+---
+# ============================================================================
+# Unattended security upgrades (Debian family)
+# ============================================================================
+
+- name: Ensure unattended-upgrades is installed
+  ansible.builtin.apt:
+    name:
+      - unattended-upgrades
+      - apt-listchanges
+    state: present
+
+- name: Deploy 50unattended-upgrades configuration
+  ansible.builtin.template:
+    src: 50unattended-upgrades.j2
+    dest: "{{ baseline_unattended_config_dir }}/50unattended-upgrades"
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+
+- name: Enable periodic upgrade timers
+  ansible.builtin.copy:
+    dest: "{{ baseline_unattended_config_dir }}/20auto-upgrades"
+    owner: root
+    group: root
+    mode: "0644"
+    content: |
+      APT::Periodic::Update-Package-Lists "1";
+      APT::Periodic::Unattended-Upgrade "1";
+      APT::Periodic::AutocleanInterval "7";
+
+- name: Ensure unattended-upgrades timer is running
+  ansible.builtin.systemd:
+    name: unattended-upgrades
+    state: started
+    enabled: true