feat(ansible): add linux-baseline role and day0_linux_baseline playbook

Introduces a single, idempotent baseline role to supersede the
overlapping day0-baseline and common roles. Capabilities are
feature-flagged so they can be toggled per-host:

  - packages (common + OS-family + per-host extras)
  - timezone + locale
  - chrony time sync against sundial
  - baseline users (jarvis admin account with SSH key + NOPASSWD sudo)
  - SSH hardening via /etc/ssh/sshd_config.d/ drop-in
  - unattended security upgrades (Debian family)
  - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf
  - journald retention caps
  - branded MOTD

Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder
for future distros via the ansible_os_family pattern.

The legacy day0-baseline and common roles remain in place for now and
will be removed during the playbook cleanup sweep, alongside the
existing playbook naming inconsistencies.

ansible/roles/linux-baseline/templates/chrony.conf.j2

@@ -0,0 +1,28 @@
+# {{ ansible_managed }}
+# Managed by Ansible - linux-baseline role
+# Local edits will be overwritten.
+
+# Primary NTP source: mk-labs internal NTP server (sundial)
+server {{ baseline_ntp_server }} iburst prefer
+
+# Fallback: public NTP pool
+pool {{ baseline_ntp_fallback_pool }} iburst maxsources 2
+
+driftfile /var/lib/chrony/chrony.drift
+
+# Step the clock if the adjustment is >1s on the first 3 corrections
+makestep 1.0 3
+
+# Sync RTC from system clock
+rtcsync
+
+# Allow chronyd to use the keyfile for hardware refclock
+{% if ansible_os_family == "Debian" %}
+keyfile /etc/chrony/chrony.keys
+{% else %}
+keyfile /etc/chrony.keys
+{% endif %}
+
+# Log selective events
+logdir /var/log/chrony
+log measurements statistics tracking