fix(host_agent): provision/deploy vars shadowed by play-var precedence

The assertion failed ("Pass steward_url/token/pubkey") because those were
injected as inventory HOST vars, but the playbooks declared them in the play
`vars:` block — and play vars OUTRANK inventory host vars, so the empty
defaults won and the injected values never reached the play.

- Pass globals (steward_url, steward_pubkey, steward_user, agent_interval) as
  extra-vars via the JSON -e @file (highest precedence, space-safe). Keep only
  the per-host steward_token as an inventory host var.
- provision.yml / install.yml: drop steward_token from `vars:` so the host var
  isn't shadowed; assertions use `| default('')` for the un-defaulted token.

This was the next layer under the inventory-format fix — first the inventory
wouldn't parse, now the injected vars actually apply.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/ansible/bundled/host_agent/install.yml

@@ -7,17 +7,18 @@
   hosts: all
   become: true
   gather_facts: false
+  # steward_token is a per-host inventory var — not declared here, or a play var
+  # would outrank and shadow it. steward_url arrives as an extra-var.
   vars:
     steward_url: ""
-    steward_token: ""
     agent_interval: 30
   tasks:
     - name: Require steward_url and steward_token
       ansible.builtin.assert:
         that:
-          - steward_url | length > 0
-          - steward_token | length > 0
-        fail_msg: "Pass steward_url and steward_token as extra-vars."
+          - steward_url | default('') | length > 0
+          - steward_token | default('') | length > 0
+        fail_msg: "Pass steward_url and steward_token (Steward injects these)."
 
     - name: Create steward-agent system user
       ansible.builtin.user:

steward/ansible/bundled/host_agent/provision.yml

@@ -19,9 +19,12 @@
   hosts: all
   become: true
   gather_facts: false
+  # steward_token is injected as a per-host inventory var (it differs per host),
+  # so it must NOT be declared here — a play var would outrank the inventory var
+  # and shadow it. The globals below arrive as extra-vars (highest precedence),
+  # which override these defaults.
   vars:
     steward_url: ""
-    steward_token: ""
     steward_pubkey: ""
     steward_user: steward
     agent_interval: 30
@@ -29,10 +32,10 @@
     - name: Require provisioning vars
       ansible.builtin.assert:
         that:
-          - steward_url | length > 0
-          - steward_token | length > 0
-          - steward_pubkey | length > 0
-        fail_msg: "Pass steward_url, steward_token and steward_pubkey as extra-vars."
+          - steward_url | default('') | length > 0
+          - steward_token | default('') | length > 0
+          - steward_pubkey | default('') | length > 0
+        fail_msg: "Pass steward_url, steward_token and steward_pubkey (Steward injects these)."
 
     # ── Managed login account ────────────────────────────────────────────────
     - name: Create the steward management account