feat(ansible): bundled first-party playbooks + built-in source

Ships a read-only "steward-builtin" source (steward/ansible/bundled/) that
always appears alongside operator-configured sources, with two playbooks:
- maintenance/docker_prune.yml — docker system prune for swarm/standalone
  nodes (safe by default; prune_all_images / prune_volumes extra-vars to
  widen). Schedule it against a swarm-node group for recurring cleanup (#869).
- host_agent/install.yml — installs/updates the host agent (mirrors
  install.sh: user, agent.py, config, hardened systemd unit), parameterised
  with steward_url + steward_token extra-vars.

get_sources() now prepends the builtin source. Tests updated to find the
configured git source by name; added coverage that the bundled playbooks are
discoverable.

Tasks #869 + agent-install (milestone #37).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/core/test_git_askpass.py

@@ -22,7 +22,8 @@ def test_get_sources_includes_http_token(tmp_path):
         ],
     }
     sources = get_sources(cfg)
-    assert sources[0]["http_token"] == "mytoken123"
+    src = next(s for s in sources if s["name"] == "repo")
+    assert src["http_token"] == "mytoken123"
 
 
 def test_get_sources_missing_http_token_defaults_empty(tmp_path):
@@ -36,7 +37,8 @@ def test_get_sources_missing_http_token_defaults_empty(tmp_path):
         ],
     }
     sources = get_sources(cfg)
-    assert sources[0]["http_token"] == ""
+    src = next(s for s in sources if s["name"] == "r")
+    assert src["http_token"] == ""
 
 
 @pytest.mark.asyncio