Add yamllint, ansible-lint, and a syntax check

scripts/check.sh runs all three and CI calls the same script. ansible.cfg keeps Ansible's temp and Galaxy caches inside the checkout so the checks work when $HOME is read-only.

.yamllint

@@ -0,0 +1,25 @@
+---
+extends: default
+
+ignore: |
+  .ansible/
+  .scratch/
+  .git/
+
+rules:
+  line-length:
+    max: 200
+    allow-non-breakable-words: true
+  comments:
+    min-spaces-from-content: 1
+  comments-indentation: false
+  document-start: disable
+  indentation:
+    spaces: 2
+    indent-sequences: consistent
+    level: warning
+  braces:
+    level: warning
+  truthy:
+    allowed-values: ["true", "false"]
+    check-keys: false