Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated

Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.

ansible/playbooks/goss-status.yaml

@@ -0,0 +1,32 @@
+---
+# Fetch the last on-host Goss timer result. Does not run a new check.
+# Usage: ansible-playbook ansible/playbooks/goss-status.yaml
+#        make goss-status
+
+- hosts: all
+  become: true
+  gather_facts: false
+  tasks:
+    - name: Read last Goss timer status
+      ansible.builtin.slurp:
+        src: /var/lib/railiance/goss/last.status
+      register: goss_status
+      failed_when: false
+
+    - name: Show last Goss timer status
+      ansible.builtin.debug:
+        msg: >-
+          {{ inventory_hostname }}:
+          {{ goss_status.content | default('') | b64decode | trim
+             if goss_status.content is defined
+             else 'no timer result yet' }}
+
+    - name: Fail when the last on-host check reported FAILED
+      ansible.builtin.stat:
+        path: /var/lib/railiance/goss/FAILED
+      register: goss_failed
+
+    - name: Report failed hosts
+      ansible.builtin.fail:
+        msg: "Goss baseline last run failed on {{ inventory_hostname }}"
+      when: goss_failed.stat.exists | default(false)