Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated

Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.

ansible/playbooks/bootstrap.yaml

@@ -5,8 +5,13 @@
     - ../inventory/group_vars/secrets.sops.yaml
   roles:
     - role: base
+      tags: [base]
     - role: sops_agent
+      tags: [sops]
     - role: custodian_agent   # injects ~/.ssh/id_custodian_agent.pub into authorized_keys
+      tags: [custodian_agent]
     - role: swapfile          # provisions swap file (size + swappiness from host_vars)
+      tags: [swap]
     - role: resource_limits   # nproc PAM caps + systemd user slice memory limits
+      tags: [resource_limits]
     # - role: wireguard   # enable if you configure WireGuard variables