feat(day0): promote expand_root_lv to a canonical day0 step

The half-disk LV pattern affects ~90% of mk-labs VMs. Treating the
fix-up as application-specific (as it was in day1_deploy_honcho.yml)
means future deploys would each carry the same boilerplate, and any
day1 author could forget it.

This commit:

  * Adds playbooks/day0_expand_root_lv.yml — standalone day0 step,
    targets {{ target | default("all") }}, honors a per-host
    expand_root_lv_skip opt-out for multi-LV layouts.

  * Adds playbooks/day0_provision.yml — umbrella playbook chaining
    day0_linux_baseline + day0_expand_root_lv, so the operator runs
    ONE command per new VM.

  * Removes expand_root_lv from day1_deploy_honcho.yml — day0 is
    assumed complete before day1 begins (cleaner separation of
    concerns, matches the convention day1_deploy_semaphore already
    follows).

  * Updates the role README to document the lifecycle position and
    the opt-out flag for hosts with multi-LV plans.

ansible/playbooks/day0_expand_root_lv.yml

@@ -0,0 +1,32 @@
+---
+# ============================================================================
+# day0_expand_root_lv.yml
+# ----------------------------------------------------------------------------
+# Reclaims unallocated PE on the root volume group, extending the root LV
+# to fill the VG and resizing the underlying filesystem (ext4 or xfs).
+#
+# Belongs to the day0 host-provisioning lifecycle. The Ubuntu Server
+# autoinstall template ships with the root LV at ~half the disk size by
+# default; this playbook is the canonical one-shot fix-up for that.
+#
+# Idempotent and safe to re-run. Hosts without LVM are no-op'd cleanly.
+#
+# Opt-out: set `expand_root_lv_skip: true` in host_vars/<host>.yml for
+# hosts where free PE should NOT be claimed by root (e.g. hosts with a
+# planned second LV in the same VG for application data).
+#
+# Usage:
+#   ansible-playbook playbooks/day0_expand_root_lv.yml
+#   ansible-playbook playbooks/day0_expand_root_lv.yml -e target=lincoln
+#   ansible-playbook playbooks/day0_expand_root_lv.yml -e target=honcho_server
+# ============================================================================
+
+- name: Expand root logical volume to fill VG
+  hosts: "{{ target | default('all') }}"
+  become: true
+  gather_facts: true
+  tasks:
+    - name: Apply expand_root_lv role unless host opts out
+      ansible.builtin.include_role:
+        name: expand_root_lv
+      when: not (expand_root_lv_skip | default(false) | bool)

ansible/playbooks/day0_provision.yml

@@ -0,0 +1,30 @@
+---
+# ============================================================================
+# day0_provision.yml
+# ----------------------------------------------------------------------------
+# Umbrella day0 playbook. Runs the full host-provisioning lifecycle in
+# the correct order against newly-built VMs, so the operator runs ONE
+# command per new host rather than chaining day0 steps manually.
+#
+# Order matters:
+#   1. linux-baseline      — timezone, NTP, packages, SSH hardening, jarvis user
+#   2. expand_root_lv      — reclaim PE left unallocated by the Ubuntu
+#                            autoinstall template default
+#
+# Idempotent: every step is safe to re-run. Suitable to apply periodically
+# from Semaphore as a baseline-drift check.
+#
+# Usage:
+#   ansible-playbook playbooks/day0_provision.yml -e target=lincoln
+#   ansible-playbook playbooks/day0_provision.yml -e target=honcho_server
+#
+# For finer control over a single phase, the constituent playbooks are:
+#   playbooks/day0_linux_baseline.yml
+#   playbooks/day0_expand_root_lv.yml
+# ============================================================================
+
+- name: Import day0 linux baseline
+  ansible.builtin.import_playbook: day0_linux_baseline.yml
+
+- name: Import day0 expand root LV
+  ansible.builtin.import_playbook: day0_expand_root_lv.yml

ansible/playbooks/day1_deploy_honcho.yml

@@ -2,13 +2,11 @@
 # ============================================================================
 # day1_deploy_honcho.yml
 # ----------------------------------------------------------------------------
-# Deploys Honcho + pgvector PostgreSQL on the `lincoln` host. Run AFTER
-# day0_linux_baseline.yml has been applied to the target.
+# Deploys Honcho + pgvector PostgreSQL on the `lincoln` host. Assumes day0
+# host provisioning (linux-baseline + expand_root_lv) is already complete.
 #
-# expand_root_lv runs first to reclaim any unallocated space left by the
-# Ubuntu autoinstall template (half-disk LV pattern).
-#
-# Usage:
+# Run via:
+#   ansible-playbook -i inventory.yml playbooks/day0_provision.yml -e target=lincoln
 #   ansible-playbook -i inventory.yml playbooks/day1_deploy_honcho.yml
 # ============================================================================
 
@@ -17,5 +15,4 @@
   become: true
   gather_facts: true
   roles:
-    - expand_root_lv
     - honcho

ansible/roles/expand_root_lv/README.md

@@ -3,13 +3,26 @@
 Idempotent role that extends the root LVM logical volume to fill its
 volume group and grows the underlying filesystem (ext4 or xfs).
 
+## Where this runs in the lifecycle
+
+Part of the **day0** host-provisioning lifecycle. The canonical entry
+points are:
+
+```
+playbooks/day0_expand_root_lv.yml   # standalone
+playbooks/day0_provision.yml        # umbrella (baseline + expand_root_lv)
+```
+
+Day1 application-deploy playbooks should NOT include this role —
+day0 is assumed complete before day1 begins.
+
 ## Why this role exists
 
 The Ubuntu Server autoinstall template (used by the mk-labs `wed`-baked
 VM templates) provisions the root LV at roughly half the available disk
-size — a longstanding installer default that surprises everyone who
-hasn't been bitten by it before. Every freshly-provisioned VM in mk-labs
-needs this fix-up before it's fully useful.
+size — a longstanding installer default that surprises every operator
+who hasn't been bitten by it before. ~90% of mk-labs VMs need this
+fix-up before they're fully useful.
 
 ## Idempotency
 
@@ -17,41 +30,35 @@ needs this fix-up before it's fully useful.
   filesystem-grow step is also skipped (nothing to resize against).
 - If the target volume group doesn't exist on the host (e.g. a non-LVM
   layout), the role exits cleanly via `meta: end_play`.
-- Safe to leave in a day1 deploy playbook so future disk expansions
+- Safe to leave in a recurring playbook so future disk expansions
   (Proxmox-side disk grow → reboot → run role) are picked up
   automatically.
 
-## Usage
+## Opt-out for multi-LV hosts
 
-Standalone:
+If a host will have a **second logical volume in the same VG** (e.g. a
+dedicated `/var/lib/postgresql` LV for a database server), this role's
+"grow root to fill VG" behavior is wrong — it will consume the free PE
+that was being reserved for the second LV.
+
+Set in `host_vars/<host>.yml`:
 
 ```yaml
-- hosts: lincoln
-  become: true
-  roles:
-    - expand_root_lv
+expand_root_lv_skip: true
 ```
 
-Or chained ahead of an application role in a day1 playbook:
-
-```yaml
-- hosts: honcho_server
-  become: true
-  roles:
-    - expand_root_lv
-    - honcho
-```
+The day0 playbook checks this flag and skips the role cleanly.
 
 ## Defaults
 
 | Variable                      | Default       | Purpose                                             |
-|-----------------------------------|---------------|---------------------------------------------------|
+|-------------------------------|---------------|-----------------------------------------------------|
 | `expand_root_lv_vg_name`      | `ubuntu-vg`   | LVM volume group name (Ubuntu installer default).   |
 | `expand_root_lv_lv_name`      | `ubuntu-lv`   | LVM logical volume name (Ubuntu installer default). |
 | `expand_root_lv_mountpoint`   | `/`           | Mountpoint of the filesystem to grow.               |
 
-Override these in `host_vars/<host>.yml` for hosts that use a different
-LVM layout. Hosts without LVM are silently no-op'd.
+Override the VG/LV names in `host_vars/<host>.yml` for hosts that use a
+different LVM layout.
 
 ## Limitations