Add yamllint, ansible-lint, and a syntax check

scripts/check.sh runs all three and CI calls the same script. ansible.cfg keeps Ansible's temp and Galaxy caches inside the checkout so the checks work when $HOME is read-only.

.ansible-lint

@@ -0,0 +1,28 @@
+---
+# Start narrow. Widen the profile once the existing playbooks pass it.
+profile: basic
+
+exclude_paths:
+  - .ansible/
+  - .scratch/
+  # These roles include postgres/roles/attach with a path built from
+  # playbook_dir. ansible-lint resolves it against the role directory instead
+  # and reports a load failure for a file that does not exist. Exclude the thin
+  # wrapper files rather than the real attach role.
+  - "*/roles/postgres/tasks/main.yaml"
+  - "*/roles/valkey/tasks/main.yaml"
+
+# Legacy debt that needs a repo-wide rename or a module rewrite. These report
+# without failing CI. Remove an entry when its last finding is fixed.
+skip_list:
+  - var-naming[no-role-prefix]
+  - name[play]
+  - command-instead-of-module
+  - yaml
+
+warn_list:
+  - experimental
+  - literal-compare
+  - no-free-form
+  - role-name
+  - command-instead-of-shell