Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated

Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.

ansible/roles/goss/templates/railiance-goss-baseline.service.j2

@@ -0,0 +1,10 @@
+[Unit]
+Description=Railiance declared-vs-live Goss baseline
+Documentation=file:///etc/goss/baseline.yaml
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/goss-baseline-check
+Nice=10
+# The wrapper records TAP even when assertions fail.
+SuccessExitStatus=0 1

ansible/roles/goss/templates/railiance-goss-baseline.timer.j2

@@ -0,0 +1,12 @@
+[Unit]
+Description=Hourly Railiance Goss baseline (RAIL-HO-WP-0009-T05)
+
+[Timer]
+OnBootSec=5min
+OnUnitActiveSec=1h
+RandomizedDelaySec=5min
+Persistent=true
+Unit=railiance-goss-baseline.service
+
+[Install]
+WantedBy=timers.target