Cut the comment bloat from the Podman playbooks

Comment blocks now stay within three lines and explain only the non-obvious. Long histories, include examples, and commented-out code are gone. No task, key, or value changed; the only data change is comment text inside the generated unit files.

prepare-server/roles/common/tasks/main.yaml

@@ -1,11 +1,5 @@
 ---
-# Tasks for the common role.
-#
-# Runs in the second play, against the account the server was prepared for
-# ({{ user }}). The .ssh directory and the authorized_keys entries are already
-# in place by the time this runs: the user role installs them during the
-# bootstrap play, because they are what makes logging in as {{ user }} --
-# and therefore this play -- possible in the first place.
+# Runs in the second play, after the user role has installed the keys this play logs in with.
 
 - name: Update the sshd config file to disable password logins
   ansible.builtin.replace:

prepare-server/roles/user/tasks/main.yaml

@@ -1,18 +1,5 @@
 ---
-# Tasks for the user role.
-#
-# Runs in the first (bootstrap) play, against the provider's bootstrap account
-# ({{ bootstrap_user }}), and does the two things that must happen before
-# anything else can: create the account this server is being prepared for
-# ({{ user }}), and install the public keys that make it reachable. Every
-# later task logs in as {{ user }} rather than as the bootstrap account, so
-# without those keys the second play cannot connect at all.
-#
-# Authentication is key based only: no password is set, which leaves the
-# account locked for password logins. The shell, group membership and the rest
-# of the account's configuration belong to the wheel/zsh roles. Setting a
-# shell here would fight the zsh role and change it back on every run, so this
-# role deliberately does not touch it.
+# The zsh role owns the login shell, so this role must not set one.
 
 - name: Create the desired user
   ansible.builtin.user:
@@ -37,14 +24,9 @@
     group: "{{ user }}"
     mode: "0644"
 
-# The second play logs in as {{ user }} with the private half of this key on
-# the control node, so this entry is what makes that login possible. It is
-# installed here, during the bootstrap play, rather than being left to depend
-# on one of the named keys below happening to be the control node's own.
-#
-# lineinfile rather than ansible.builtin.authorized_key: the latter redirects
-# to ansible.posix, whose 2.1.0 module imports a deprecated helper and emits a
-# deprecation warning on every run. This is the same guarantee without it.
+# The second play logs in with this key, so bootstrap installs it here rather
+# than relying on a named key below. It uses lineinfile because authorized_key
+# redirects to ansible.posix 2.1.0, which imports a deprecated helper and warns on every run.
 - name: Authorize the control node's key for the new user
   ansible.builtin.lineinfile:
     dest: "/home/{{ user }}/.ssh/authorized_keys"