feat(system_check): add safety check for physical installs

roles/system_check/tasks/main.yml

@@ -1,4 +1,14 @@
 ---
+- name: Physical install safety confirmation
+  when: system_cfg.type == "physical"
+  ansible.builtin.assert:
+    that:
+      - physical_install_confirmed | default(false) | bool
+    fail_msg: >-
+      DANGER: Physical install will WIPE {{ install_drive }} on {{ inventory_hostname }}.
+      Set physical_install_confirmed=true in inventory to proceed.
+    quiet: true
+
 - name: VM existence protection check
   when: system_cfg.type == "virtual"
   block: