feat(cis): add selectable profile and per-rule hardening toggles

roles/cis/tasks/files.yml

@@ -1,5 +1,6 @@
 ---
-- name: Ensure files exist
+- name: Ensure cron and at access files exist
+  when: cis_effective_rules.cron_at_access | default(false)
   ansible.builtin.file:
     path: "{{ item }}"
     state: touch
@@ -7,10 +8,19 @@
   loop:
     - /mnt/etc/at.allow
     - /mnt/etc/cron.allow
+
+- name: Ensure TCP wrapper files exist
+  when: cis_effective_rules.tcp_wrappers | default(false)
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: touch
+    mode: "0600"
+  loop:
     - /mnt/etc/hosts.allow
     - /mnt/etc/hosts.deny
 
-- name: Ensure files do not exist
+- name: Ensure cron and at deny files do not exist
+  when: cis_effective_rules.cron_at_access | default(false)
   ansible.builtin.file:
     path: "{{ item }}"
     state: absent