feat: implement WP-0002 — Goss test suite, verify playbook, and ADR-002

- goss/baseline.yaml: assertions for all spec/server-baseline.yaml items
  (packages, services, SSH config, UFW rules, admin user, fail2ban, HISTCONTROL)
- goss/vars/baseline-vars.yaml: parameterised ports and paths
- ansible/roles/goss/: installs Goss binary (v0.4.9), deploys tests,
  runs assertions in TAP format, fetches report to reports/
- ansible/playbooks/verify.yaml: playbook wrapping the goss role
- Makefile: add 'make verify' target; update 'make status' with hint
- docs/adr/ADR-002: formal repo boundary — railiance-hosts vs railiance-bootstrap
- workplans/RAIL-HO-WP-0002: registered workstream 8fed53c2, T03–T06 done

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

workplans/RAIL-HO-WP-0002-server-spec-and-test-suite.md

@@ -7,7 +7,7 @@ repo: railiance-hosts
 status: active
 owner: railiance
 topic_slug: railiance
-state_hub_workstream_id: ""   # register after creating workstream in hub
+state_hub_workstream_id: "8fed53c2-4c39-4471-8bb9-61f58771fe0c"
 created: "2026-03-09"
 updated: "2026-03-09"
 ---
@@ -123,8 +123,10 @@ and tests must satisfy.
 
 ```task
 id: T03
-status: todo
+status: done
+completed: "2026-03-09"
 priority: high
+state_hub_task_id: "a34a1626-ff38-4925-a957-d94036fbded6"
 ```
 
 Create `goss/baseline.yaml` with Goss assertions that implement every item in
@@ -189,8 +191,10 @@ user:
 
 ```task
 id: T04
-status: todo
+status: done
+completed: "2026-03-09"
 priority: high
+state_hub_task_id: "c072c45b-f18d-45be-b747-6d219c3f1439"
 ```
 
 Create `ansible/roles/goss/` with tasks that:
@@ -217,8 +221,10 @@ clean node, non-zero on a deliberately broken one (test with a manual config cha
 
 ```task
 id: T05
-status: todo
+status: done
+completed: "2026-03-09"
 priority: medium
+state_hub_task_id: "a8100b8e-aed0-4bb4-a0dc-a6bdf3938b8d"
 ```
 
 Add to Makefile:
@@ -239,8 +245,10 @@ Also update `make status` to print a summary line ("All assertions passed" /
 
 ```task
 id: T06
-status: todo
+status: done
+completed: "2026-03-09"
 priority: medium
+state_hub_task_id: "c3d98022-638d-4dcb-bdc7-a9501e1b6cd9"
 ```
 
 Create `docs/adr/ADR-002-repo-boundary-hosts-vs-bootstrap.md` documenting: