feat(ansible): add linux-baseline role and day0_linux_baseline playbook

Introduces a single, idempotent baseline role to supersede the
overlapping day0-baseline and common roles. Capabilities are
feature-flagged so they can be toggled per-host:

  - packages (common + OS-family + per-host extras)
  - timezone + locale
  - chrony time sync against sundial
  - baseline users (jarvis admin account with SSH key + NOPASSWD sudo)
  - SSH hardening via /etc/ssh/sshd_config.d/ drop-in
  - unattended security upgrades (Debian family)
  - sysctl drop-in at /etc/sysctl.d/99-mk-labs.conf
  - journald retention caps
  - branded MOTD

Ubuntu/Debian is first-class; vars/RedHat.yml provides a placeholder
for future distros via the ansible_os_family pattern.

The legacy day0-baseline and common roles remain in place for now and
will be removed during the playbook cleanup sweep, alongside the
existing playbook naming inconsistencies.

ansible/roles/linux-baseline/vars/Debian.yml

@@ -0,0 +1,22 @@
+---
+# ============================================================================
+# Debian-family overrides (Ubuntu, Debian)
+# ============================================================================
+
+# Package facts module needs python3-apt on the target.
+baseline_packages_family:
+  - python3-apt
+  - apt-transport-https
+  - software-properties-common
+  - lsb-release
+  - unattended-upgrades
+
+baseline_sudo_group: sudo
+
+# Service names
+baseline_chrony_service: chrony
+baseline_chrony_config_path: /etc/chrony/chrony.conf
+baseline_sshd_service: ssh
+
+# Unattended-upgrades file locations
+baseline_unattended_config_dir: /etc/apt/apt.conf.d

ansible/roles/linux-baseline/vars/RedHat.yml

@@ -0,0 +1,19 @@
+---
+# ============================================================================
+# RedHat-family overrides (Rocky, AlmaLinux, RHEL) - placeholder
+# ============================================================================
+# This file exists to make the OS abstraction visible. It is not exercised
+# today because mk-labs is all-Ubuntu. Flesh out when a RHEL-family host
+# enters the fleet.
+
+baseline_packages_family:
+  - dnf-automatic
+  - python3-dnf
+
+baseline_sudo_group: wheel
+
+baseline_chrony_service: chronyd
+baseline_chrony_config_path: /etc/chrony.conf
+baseline_sshd_service: sshd
+
+baseline_unattended_config_dir: /etc/dnf/automatic.conf.d