feat(ansible): bundled first-party playbooks + built-in source

Ships a read-only "steward-builtin" source (steward/ansible/bundled/) that
always appears alongside operator-configured sources, with two playbooks:
- maintenance/docker_prune.yml — docker system prune for swarm/standalone
  nodes (safe by default; prune_all_images / prune_volumes extra-vars to
  widen). Schedule it against a swarm-node group for recurring cleanup (#869).
- host_agent/install.yml — installs/updates the host agent (mirrors
  install.sh: user, agent.py, config, hardened systemd unit), parameterised
  with steward_url + steward_token extra-vars.

get_sources() now prepends the builtin source. Tests updated to find the
configured git source by name; added coverage that the bundled playbooks are
discoverable.

Tasks #869 + agent-install (milestone #37).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/ansible/bundled/maintenance/docker_prune.yml

@@ -0,0 +1,26 @@
+---
+# Reclaim disk on Docker / Docker Swarm nodes by removing unused data.
+# Safe by default: prunes dangling images, stopped containers, unused networks
+# and build cache. Set extra-vars to widen scope:
+#   prune_all_images=true   also remove ALL unused images (not just dangling)
+#   prune_volumes=true      also remove unused named volumes (data loss risk)
+- name: Docker system prune
+  hosts: all
+  gather_facts: false
+  become: true
+  vars:
+    prune_all_images: false
+    prune_volumes: false
+  tasks:
+    - name: Run docker system prune
+      ansible.builtin.command:
+        argv: >-
+          {{ ['docker', 'system', 'prune', '-f']
+             + (['-a'] if prune_all_images | bool else [])
+             + (['--volumes'] if prune_volumes | bool else []) }}
+      register: prune_result
+      changed_when: "'Total reclaimed space: 0B' not in prune_result.stdout"
+
+    - name: Report reclaimed space
+      ansible.builtin.debug:
+        msg: "{{ prune_result.stdout_lines | select | list }}"