Add Ansible playbook to deliver validator-agent to the validators

Run from the jump host: on each validator it updates the git clone in
/opt/cloud-ip-validator, builds the image there, stops and removes the
current container and starts a new one from the new image. Run
parameters live in an env file (deploy/ansible/env/validator-agent.env,
git-ignored, template committed).

The image is built before the running container is touched, so a failed
build leaves the old container running. Hosts are updated in waves
(1, 4, rest) and any failure stops the run. validator_id comes from the
inventory and is checked against the running container before it is
replaced. Only ansible.builtin modules are used, so the validators need
no extra packages.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitignore

@@ -5,6 +5,8 @@
 !/deploy/docker/.env.example
 !/deploy/docker/.env.prod.example
 /deploy/docker/control-api/control-api.docker.yaml
+# Ansible: рабочий env-файл запуска validator-agent (шаблон .example остаётся в git).
+/deploy/ansible/env/*.env
 /rxprod-compose/.env
 
 # Live runtime database for the rxprod-compose control-api container.