Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated

Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.

ansible/roles/base/handlers/main.yml

@@ -1,4 +1,9 @@
 ---
+- name: Restart sshd
+  ansible.builtin.service:
+    name: ssh
+    state: restarted
+
 - name: Restart fail2ban
   ansible.builtin.service:
     name: fail2ban