Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated

Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.

ansible/roles/sops_agent/tasks/main.yml

@@ -1,5 +1,6 @@
 ---
 - name: Install age
+  tags: [sops]
   ansible.builtin.shell: |
     set -euo pipefail
     if ! command -v age >/dev/null; then
@@ -9,12 +10,14 @@
     executable: /bin/bash
 
 - name: Install sops
+  tags: [sops]
   ansible.builtin.get_url:
     url: https://github.com/getsops/sops/releases/download/v3.9.0/sops-v3.9.0.linux.amd64
     dest: /usr/local/bin/sops
     mode: '0755'
 
 - name: Create SOPS age dir
+  tags: [sops]
   ansible.builtin.file:
     path: /root/.config/sops/age
     state: directory