feat(ansible): playbooks self-describe via "# description:" comment

Playbooks can ship a human description Steward reads and shows when one is
selected. Convention: a `# description: <text>` magic comment (Ansible rejects
unknown play keys, so a comment is the portable place — works for third-party
playbooks too); falls back to the first play's name:. sources
.discover_playbook_description().

Surfaced at the top of the shared _playbook_vars.html partial, which loads on
playbook selection in the host run form, schedules form, and browse run form.
All four bundled playbooks (provision/install/update/docker_prune) now carry a
description line. Unit tests added.

Scribe #900.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_playbook_variables.py

@@ -2,7 +2,10 @@
 import json
 
 from steward.ansible.executor import build_extra_vars_file
-from steward.ansible.sources import discover_playbook_variables
+from steward.ansible.sources import (
+    discover_playbook_description,
+    discover_playbook_variables,
+)
 
 
 def _names(variables):
@@ -108,3 +111,29 @@ def test_extra_vars_file_roundtrip_and_space_safe():
 def test_extra_vars_file_empty_is_noop():
     assert build_extra_vars_file({}, "/td") == ([], [])
     assert build_extra_vars_file(None, "/td") == ([], [])
+
+
+# ── Playbook description discovery ────────────────────────────────────────────
+
+def test_description_from_magic_comment():
+    content = """---
+# description: Reclaim disk by pruning Docker.
+- hosts: all
+  name: Docker prune
+  tasks: []
+"""
+    assert discover_playbook_description(content) == "Reclaim disk by pruning Docker."
+
+
+def test_description_case_insensitive_key():
+    assert discover_playbook_description("# DESCRIPTION:  trimmed  \n- hosts: all") == "trimmed"
+
+
+def test_description_falls_back_to_play_name():
+    content = "- hosts: all\n  name: Configure web servers\n  tasks: []\n"
+    assert discover_playbook_description(content) == "Configure web servers"
+
+
+def test_description_empty_when_neither_present():
+    assert discover_playbook_description("- hosts: all\n  tasks: []\n") == ""
+    assert discover_playbook_description("not: : valid") == ""