Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated

Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.

ansible/roles/resource_limits/tasks/main.yml

@@ -10,6 +10,7 @@
 #   user_memory_swap_max:        systemd MemorySwapMax (default: 512M)
 
 - name: Set PAM nproc limits
+  tags: [resource_limits]
   ansible.builtin.template:
     src: nproc-limits.conf.j2
     dest: /etc/security/limits.d/60-nproc-{{ resource_limit_user | default('tegwick') }}.conf
@@ -18,6 +19,7 @@
     mode: '0644'
 
 - name: Ensure systemd user slice override directory
+  tags: [resource_limits]
   ansible.builtin.file:
     path: "/etc/systemd/system/user-{{ resource_limit_uid | default(1000) }}.slice.d"
     state: directory
@@ -26,6 +28,7 @@
     mode: '0755'
 
 - name: Set systemd user slice memory limits
+  tags: [resource_limits]
   ansible.builtin.template:
     src: user-slice-limits.conf.j2
     dest: "/etc/systemd/system/user-{{ resource_limit_uid | default(1000) }}.slice.d/limits.conf"