Add opt-in Railiance host time and private authority automation

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

ansible/roles/railiance_clock/tasks/main.yaml

@@ -0,0 +1,50 @@
+---
+- name: Converge explicitly admitted Railiance Clock host scope
+  when: railiance_clock_enabled | bool
+  block:
+    - name: Require supported host and concrete admission
+      ansible.builtin.assert:
+        that:
+          - ansible_system == 'Linux'
+          - ansible_distribution == 'Ubuntu'
+          - ansible_distribution_major_version == '24'
+          - railiance_clock_admission_ref | length > 0
+          - railiance_clock_upstreams | length > 0
+          - railiance_clock_host_drift_ppm | int >= 500
+          - railiance_clock_max_error_ns | int > railiance_clock_measurement_margin_ns | int
+    - name: Gather service facts without changing clocks
+      ansible.builtin.service_facts:
+    - name: Refuse competing discipline daemons
+      ansible.builtin.assert:
+        that:
+          - ansible_facts.services.get(item, {}).get('state', 'stopped') != 'running'
+      loop: [chrony.service, chronyd.service, ntp.service, ntpd.service]
+    - name: Ensure the existing time daemon is installed
+      ansible.builtin.assert:
+        that: "'systemd-timesyncd.service' in ansible_facts.services"
+    - name: Configure reviewed timesyncd baseline only when explicitly selected
+      when: railiance_clock_manage_timesyncd | bool
+      block:
+        - name: Create timesyncd configuration directory
+          ansible.builtin.file:
+            path: /etc/systemd/timesyncd.conf.d
+            state: directory
+            owner: root
+            group: root
+            mode: '0755'
+        - name: Install sole owner drop-in
+          ansible.builtin.template:
+            src: timesyncd.conf.j2
+            dest: /etc/systemd/timesyncd.conf.d/60-railiance-clock.conf
+            owner: root
+            group: root
+            mode: '0644'
+          notify: Restart reviewed timesyncd
+        - name: Keep admitted daemon enabled
+          ansible.builtin.systemd:
+            name: systemd-timesyncd
+            enabled: true
+            state: started
+    - name: Install authority and health export
+      when: railiance_clock_authority_enabled | bool
+      ansible.builtin.include_tasks: authority.yaml