Make S1 handoff read-only by default

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

ansible/playbooks/verify-refresh.yaml

@@ -0,0 +1,15 @@
+---
+# verify-refresh.yaml — Install/refresh Goss, run assertions, fetch TAP.
+#
+# This is a host-mutating operation. Review the rendered baseline and use it
+# only when updating the verification surface. Routine verification and the S1
+# handoff use the read-only verify.yaml playbook.
+
+- name: Refresh and verify the managed Goss surface
+  hosts: all
+  become: true
+  gather_facts: true
+  vars_files:
+    - ../inventory/group_vars/all.yaml
+  roles:
+    - role: goss