feat(ansible): add swapfile + resource_limits roles; add CoulombCore to inventory

T01: roles/swapfile — idempotent 4GB swapfile, vm.swappiness=10, fstab entry
T02: roles/resource_limits — PAM nproc caps (512/1024), systemd user-1000.slice
     memory limits (1500M/512M); templated per-host via host_vars
- inventory/host_vars/CoulombCore.yml — host-specific vars for both roles
- inventory/servers.yaml — add CoulombCore with id_ops SSH key
- inventory_from_yaml.py — load host_vars files into Ansible hostvars
- playbooks/bootstrap.yaml — include swapfile + resource_limits roles
- workplans/WP-0004 — flag T04/T09/T10 needs_human, add CoulombCore-local convergence note

Codifies manual INC-002 hardening. See RAIL-HO-WP-0004-T01/T02.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/inventory_from_yaml.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-import json, yaml, subprocess, os, sys, pathlib
+import json, yaml, subprocess, os, sys, pathlib, glob
 
 def load_servers():
     with open(os.path.join(os.path.dirname(__file__), '..', 'inventory', 'servers.yaml')) as f:
@@ -17,6 +17,15 @@ def load_tf_outputs():
     except Exception:
         return {}
 
+def load_host_vars(name):
+    """Load host_vars/<name>.yml if it exists."""
+    script_dir = os.path.dirname(__file__)
+    path = os.path.join(script_dir, '..', 'inventory', 'host_vars', f'{name}.yml')
+    if os.path.exists(path):
+        with open(path) as f:
+            return yaml.safe_load(f) or {}
+    return {}
+
 def main():
     server_list = load_servers()
     tf = load_tf_outputs()
@@ -25,10 +34,14 @@ def main():
     for s in server_list:
         name = s['name']
         host_names.append(name)
-        hostvars[name] = {
+        hvars = {
             "ansible_host": tf.get(name) or s.get('ip'),
-            "ansible_user": s.get('ssh_user', 'admin')
+            "ansible_user": s.get('ssh_user', 'admin'),
         }
+        if s.get('ssh_key'):
+            hvars["ansible_ssh_private_key_file"] = s['ssh_key']
+        hvars.update(load_host_vars(name))
+        hostvars[name] = hvars
     inv = {
         "all": {"hosts": host_names},
         "_meta": {"hostvars": hostvars}