fix(custodian-agent): dedicated playbook, correct working dir

- ansible/playbooks/custodian-agent.yaml: minimal playbook with only
  the custodian_agent role — avoids loading base/sops_agent/etc when
  all we need is key injection
- Makefile: use custodian-agent.yaml in provision targets; remove
  --tags workaround (was fragile; standalone playbook is correct)

Manual invocation (from CoulombCore):
  cd ~/railiance-infra/ansible
  ansible-playbook playbooks/custodian-agent.yaml -u tegwick --limit Railiance01

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/playbooks/custodian-agent.yaml

@@ -0,0 +1,16 @@
+---
+# Minimal playbook — only deploys the Custodian automation SSH key.
+# Use this instead of bootstrap.yaml when you only need key injection:
+#
+#   cd ~/railiance-infra/ansible
+#   ansible-playbook playbooks/custodian-agent.yaml -u tegwick --limit Railiance01
+#
+# Or via Makefile from repo root:
+#   make provision-custodian-agent-host HOST=Railiance01
+
+- hosts: all
+  become: true
+  vars_files:
+    - ../inventory/group_vars/all.yaml
+  roles:
+    - role: custodian_agent