Add yamllint, ansible-lint, and a syntax check

scripts/check.sh runs all three and CI calls the same script. ansible.cfg keeps Ansible's temp and Galaxy caches inside the checkout so the checks work when $HOME is read-only.

.gitignore

@@ -3,3 +3,8 @@
 
 # Provider bootstrap private key for prepare-server. Never commit this.
 bootstrap.pem
+
+# Local check output and scratch files.
+.ansible/
+.scratch/
+*.log