Add yamllint, ansible-lint, and a syntax check

scripts/check.sh runs all three and CI calls the same script. ansible.cfg keeps Ansible's temp and Galaxy caches inside the checkout so the checks work when $HOME is read-only.

ansible.cfg

@@ -0,0 +1,20 @@
+[defaults]
+# The fleet inventory committed next to this file.
+inventory = hosts
+
+# Ansible writes per-run temp files under $HOME by default. The agent sandbox
+# and some CI images mount $HOME read-only, which makes every run fail before
+# it parses a playbook. Keep the temp tree inside the checkout instead.
+local_tmp = ./.ansible/tmp
+
+# Keep Galaxy collections local too, so CI and the check script do not depend on
+# a writable $HOME.
+collections_path = ./.ansible/collections
+
+# .retry files are noise now that every playbook is checked in CI.
+retry_files_enabled = False
+
+[galaxy]
+# Galaxy caches API responses under $HOME by default, which breaks the same
+# read-only sandbox.
+cache_dir = ./.ansible/galaxy_cache