Add yamllint, ansible-lint, and a syntax check

scripts/check.sh runs all three and CI calls the same script. ansible.cfg keeps Ansible's temp and Galaxy caches inside the checkout so the checks work when $HOME is read-only.

requirements.yml

@@ -0,0 +1,7 @@
+---
+# Collections the playbooks import. CI and scripts/check.sh install these into
+# .ansible/collections so ansible-lint can resolve every module.
+collections:
+  - name: community.docker
+  - name: community.general
+  - name: ansible.posix