feat(ansible): bundled first-party playbooks + built-in source

Ships a read-only "steward-builtin" source (steward/ansible/bundled/) that
always appears alongside operator-configured sources, with two playbooks:
- maintenance/docker_prune.yml — docker system prune for swarm/standalone
  nodes (safe by default; prune_all_images / prune_volumes extra-vars to
  widen). Schedule it against a swarm-node group for recurring cleanup (#869).
- host_agent/install.yml — installs/updates the host agent (mirrors
  install.sh: user, agent.py, config, hardened systemd unit), parameterised
  with steward_url + steward_token extra-vars.

get_sources() now prepends the builtin source. Tests updated to find the
configured git source by name; added coverage that the bundled playbooks are
discoverable.

Tasks #869 + agent-install (milestone #37).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/core/test_builtin_source.py

@@ -0,0 +1,19 @@
+"""The bundled first-party playbook source is always present and discoverable."""
+from steward.ansible.sources import (
+    BUILTIN_SOURCE_NAME,
+    discover_playbooks,
+    get_sources,
+)
+
+
+def test_builtin_source_is_first_and_local():
+    sources = get_sources({"sources": []})
+    assert sources[0]["name"] == BUILTIN_SOURCE_NAME
+    assert sources[0]["type"] == "local"
+
+
+def test_bundled_playbooks_are_discoverable():
+    builtin = get_sources({"sources": []})[0]
+    playbooks = discover_playbooks(builtin["path"])
+    assert "maintenance/docker_prune.yml" in playbooks
+    assert "host_agent/install.yml" in playbooks

tests/core/test_git_askpass.py

@@ -22,7 +22,8 @@ def test_get_sources_includes_http_token(tmp_path):
         ],
     }
     sources = get_sources(cfg)
-    assert sources[0]["http_token"] == "mytoken123"
+    src = next(s for s in sources if s["name"] == "repo")
+    assert src["http_token"] == "mytoken123"
 
 
 def test_get_sources_missing_http_token_defaults_empty(tmp_path):
@@ -36,7 +37,8 @@ def test_get_sources_missing_http_token_defaults_empty(tmp_path):
         ],
     }
     sources = get_sources(cfg)
-    assert sources[0]["http_token"] == ""
+    src = next(s for s in sources if s["name"] == "r")
+    assert src["http_token"] == ""
 
 
 @pytest.mark.asyncio