feat(custodian-agent): Ansible role + Makefile for Custodian SSH identity

Establishes a dedicated SSH keypair for the Custodian automation agent:
- ansible/roles/custodian_agent/: authorized_key task (tagged custodian_agent)
- ansible/inventory/group_vars/all.yaml: custodian_agent_user/pubkey vars
- ansible/playbooks/bootstrap.yaml: custodian_agent role added
- Makefile: provision-custodian-agent / provision-custodian-agent-host targets

Keypair generation: cd ~/the-custodian && make custodian-keygen
Then deploy:        cd ~/railiance-infra && make provision-custodian-agent

The private key lives at ~/.ssh/id_custodian_agent — never committed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/inventory/group_vars/all.yaml

@@ -0,0 +1,20 @@
+# Ansible group vars — applied to all managed hosts.
+#
+# custodian_agent_pubkey: the SSH public key for the Custodian automation identity.
+#
+# HOW TO SET THIS:
+#   1. Generate the keypair on the workstation (one-time):
+#        cd ~/the-custodian && make custodian-keygen
+#      This creates ~/.ssh/id_custodian_agent (private, never committed)
+#      and writes the public key to:
+#        ~/railiance-infra/ansible/inventory/group_vars/all.yaml  ← this file
+#
+#   2. Commit the updated all.yaml (public key only — safe to commit).
+#
+#   3. Deploy to all managed hosts:
+#        cd ~/railiance-infra && make provision-custodian-agent
+#
+# The key below is a placeholder — replace by running `make custodian-keygen`.
+
+custodian_agent_user: tegwick
+custodian_agent_pubkey: ""