feat: datetime reports, auto-commit on verify, register pruning EP

- Include time in TAP report filename (ISO 8601: date + HHmmssZ)
- Add changed_when: false to report write task — verify play now shows
  changed=0 on a clean run (all green recap)
- make verify auto-commits new reports to repo after a passing run;
  exits non-zero before committing if assertions fail
- Register EP-RAIL-001: report pruning extension point for future
  implementation when reports/ accumulates beyond a threshold

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Makefile

@@ -198,11 +198,14 @@ status: ## Show live security state of all hosts (UFW, fail2ban, SSH hardening)
 	@echo ""
 	@echo "--- Hint: run 'make verify' for a structured pass/fail report ---"
 
-verify: ## Run Goss test suite against all hosts — exits non-zero on failure
+verify: ## Run Goss test suite against all hosts, commit TAP reports — exits non-zero on failure
 	@echo "Running Goss baseline assertions..."
-	@cd $(ANS_DIR) && ansible-playbook playbooks/verify.yaml -u $(SSH_USER) && \
-	  echo "All assertions passed." || \
+	@cd $(ANS_DIR) && ansible-playbook playbooks/verify.yaml -u $(SSH_USER) || \
 	  (echo "One or more assertions FAILED — see reports/ for TAP output." && exit 1)
+	@echo "All assertions passed."
+	@git add reports/ && \
+	  git diff --cached --quiet && echo "No new reports to commit." || \
+	  git commit -m "chore: Goss verification reports $$(date -u +%Y-%m-%dT%H%M%SZ)"
 
 converge: ## Converge all hosts to the baseline (idempotent)
 	cd $(ANS_DIR) && ansible-playbook $(PLAY) -u $(SSH_USER)