Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated

Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.

ansible/roles/swapfile/tasks/main.yml

@@ -6,17 +6,20 @@
 #   swap_swappiness: vm.swappiness value (default: 10)
 
 - name: Check if swapfile exists with correct size
+  tags: [swap]
   ansible.builtin.stat:
     path: /swapfile
   register: swapfile_stat
 
 - name: Allocate swapfile (fallocate)
+  tags: [swap]
   ansible.builtin.command:
     cmd: "fallocate -l {{ (swap_size_gb | default(4)) | int }}G /swapfile"
     creates: /swapfile
   when: not swapfile_stat.stat.exists
 
 - name: Set swapfile permissions
+  tags: [swap]
   ansible.builtin.file:
     path: /swapfile
     owner: root
@@ -24,17 +27,20 @@
     mode: '0600'
 
 - name: Format swapfile
+  tags: [swap]
   ansible.builtin.command:
     cmd: mkswap /swapfile
   when: not swapfile_stat.stat.exists
 
 - name: Enable swapfile
+  tags: [swap]
   ansible.builtin.command:
     cmd: swapon /swapfile
   when: not swapfile_stat.stat.exists
   ignore_errors: true  # already active is not an error
 
 - name: Ensure swapfile in /etc/fstab
+  tags: [swap]
   ansible.builtin.lineinfile:
     path: /etc/fstab
     regexp: '^/swapfile'
@@ -42,6 +48,7 @@
     state: present
 
 - name: Set vm.swappiness at runtime
+  tags: [swap]
   ansible.posix.sysctl:
     name: vm.swappiness
     value: "{{ swap_swappiness | default(10) }}"
@@ -49,6 +56,7 @@
     reload: true
 
 - name: Persist vm.swappiness across reboots
+  tags: [swap]
   ansible.builtin.copy:
     dest: /etc/sysctl.d/60-swappiness.conf
     owner: root