feat: implement WP-0002 — Goss test suite, verify playbook, and ADR-002

- goss/baseline.yaml: assertions for all spec/server-baseline.yaml items
  (packages, services, SSH config, UFW rules, admin user, fail2ban, HISTCONTROL)
- goss/vars/baseline-vars.yaml: parameterised ports and paths
- ansible/roles/goss/: installs Goss binary (v0.4.9), deploys tests,
  runs assertions in TAP format, fetches report to reports/
- ansible/playbooks/verify.yaml: playbook wrapping the goss role
- Makefile: add 'make verify' target; update 'make status' with hint
- docs/adr/ADR-002: formal repo boundary — railiance-hosts vs railiance-bootstrap
- workplans/RAIL-HO-WP-0002: registered workstream 8fed53c2, T03–T06 done

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/playbooks/verify.yaml

@@ -0,0 +1,13 @@
+---
+# verify.yaml — Deploy Goss, run baseline assertions, fetch TAP results.
+# Exit code mirrors Goss: 0 = all pass, non-zero = failures.
+#
+# Usage:
+#   ansible-playbook ansible/playbooks/verify.yaml -u admin
+#   make verify
+
+- hosts: all
+  become: true
+  gather_facts: true
+  roles:
+    - role: goss

ansible/roles/goss/tasks/main.yml

@@ -0,0 +1,56 @@
+---
+# Role: goss
+# Installs the Goss binary, deploys test files, runs assertions, fetches results.
+
+- name: Set Goss version and paths
+  ansible.builtin.set_fact:
+    goss_version: "0.4.9"
+    goss_bin: /usr/local/bin/goss
+    goss_dir: /etc/goss
+
+- name: Create Goss config directory
+  ansible.builtin.file:
+    path: "{{ goss_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Download Goss binary
+  ansible.builtin.get_url:
+    url: "https://github.com/goss-org/goss/releases/download/v{{ goss_version }}/goss-linux-amd64"
+    dest: "{{ goss_bin }}"
+    mode: "0755"
+    checksum: "sha256:https://github.com/goss-org/goss/releases/download/v{{ goss_version }}/goss-linux-amd64.sha256"
+  register: goss_download
+
+- name: Copy baseline test file
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../goss/baseline.yaml"
+    dest: "{{ goss_dir }}/baseline.yaml"
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Run Goss assertions (TAP output)
+  ansible.builtin.command:
+    cmd: "{{ goss_bin }} -g {{ goss_dir }}/baseline.yaml validate --format tap"
+  register: goss_result
+  failed_when: goss_result.rc != 0
+  changed_when: false
+
+- name: Ensure local reports directory exists
+  ansible.builtin.file:
+    path: "{{ playbook_dir }}/../reports"
+    state: directory
+    mode: "0755"
+  delegate_to: localhost
+  become: false
+
+- name: Write TAP report locally
+  ansible.builtin.copy:
+    content: "{{ goss_result.stdout }}"
+    dest: "{{ playbook_dir }}/../reports/goss-{{ inventory_hostname }}-{{ ansible_date_time.date }}.tap"
+    mode: "0644"
+  delegate_to: localhost
+  become: false