feat: golden-image build support (cloud-init on EL, selinux relabel, SSH wait)

roles/global_defaults/defaults/main.yml

@@ -58,6 +58,8 @@ system_defaults:
   version: ""
   filesystem: "ext4"
   name: ""
+  # consumed by the golden produce/deploy wrappers, not the bootstrap itself
+  source: ""
   id: ""
   cpus: 0
   memory: 0 # MiB
@@ -101,6 +103,10 @@ system_defaults:
     bits: 512
     pbkdf: "argon2id"
   features:
+    # Bake cloud-init for the deterministic clone-deploy golden path; off by
+    # default (ansible-direct everywhere, smaller image). Package name is
+    # uniform across families.
+    cloud_init: false
     cis:
       enabled: false
       profile: default # default|l1|l2 (default = current house behaviour)