Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated

Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.

ansible/roles/goss/tasks/main.yml

@@ -32,6 +32,39 @@
     group: root
     mode: "0644"
 
+- name: Install recurring Goss check wrapper
+  ansible.builtin.copy:
+    src: goss-baseline-check.sh
+    dest: /usr/local/sbin/goss-baseline-check
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Install Goss baseline systemd service
+  ansible.builtin.template:
+    src: railiance-goss-baseline.service.j2
+    dest: /etc/systemd/system/railiance-goss-baseline.service
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Reload systemd daemon
+
+- name: Install Goss baseline systemd timer
+  ansible.builtin.template:
+    src: railiance-goss-baseline.timer.j2
+    dest: /etc/systemd/system/railiance-goss-baseline.timer
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Reload systemd daemon
+
+- name: Enable hourly Goss baseline timer
+  ansible.builtin.systemd:
+    name: railiance-goss-baseline.timer
+    enabled: true
+    state: started
+    daemon_reload: true
+
 - name: Run Goss assertions (TAP output)
   ansible.builtin.command:
     cmd: "{{ goss_bin }} -g {{ goss_dir }}/baseline.yaml validate --format tap"