fix(semaphore): add ANSIBLE_COLLECTIONS_PATH to default environment

Semaphore runs ansible-playbook from the repo root, so ansible.cfg in
ansible/ is never loaded. The env var is the reliable path.

Also persists the setting in group_vars so semaphore_configure re-runs
don't regress it.

ansible/group_vars/all/semaphore.yml

@@ -104,6 +104,9 @@ semaphore_config:
         # from the playbook's directory as I first assumed). Path is
         # therefore relative to repo root, not playbook dir.
         ANSIBLE_ROLES_PATH: "ansible/roles"
+        # Collections are installed by the semaphore role into a host-side
+        # directory bind-mounted into the container at this path.
+        ANSIBLE_COLLECTIONS_PATH: "/opt/ansible-collections"
 
   templates:
     - name: "day0_linux_baseline"