fix(semaphore): set ANSIBLE_ROLES_PATH in default env

Semaphore runs ansible-playbook from the playbook's directory, not
from ansible/ where ansible.cfg lives. Roles aren't found at runtime:
'role linux-baseline was not found'.

Set ANSIBLE_ROLES_PATH=../roles in the default environment so the
search picks up ansible/roles/ relative to the playbook directory.

ansible/group_vars/all/semaphore.yml

@@ -100,6 +100,11 @@ semaphore_config:
       env:
         ANSIBLE_HOST_KEY_CHECKING: "False"
         ANSIBLE_FORCE_COLOR: "True"
+        # Semaphore runs ansible-playbook from the playbook's directory
+        # (ansible/playbooks/), which doesn't pick up ansible.cfg from
+        # the parent ansible/ dir. Point roles_path at the canonical
+        # location relative to that working directory.
+        ANSIBLE_ROLES_PATH: "../roles"
 
   templates:
     - name: "day0_linux_baseline"