Add Ansible playbook to deliver validator-agent to the validators

Run from the jump host: on each validator it updates the git clone in
/opt/cloud-ip-validator, builds the image there, stops and removes the
current container and starts a new one from the new image. Run
parameters live in an env file (deploy/ansible/env/validator-agent.env,
git-ignored, template committed).

The image is built before the running container is touched, so a failed
build leaves the old container running. Hosts are updated in waves
(1, 4, rest) and any failure stops the run. validator_id comes from the
inventory and is checked against the running container before it is
replaced. Only ansible.builtin modules are used, so the validators need
no extra packages.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

deploy/ansible/roles/validator_agent/vars/main.yml

@@ -0,0 +1,7 @@
+---
+# git с явным safe.directory: клон может принадлежать другому пользователю.
+git_cmd: "git -c safe.directory={{ repo_dir }} -C {{ repo_dir }}"
+# validator_id в control-api: из inventory, иначе имя хоста.
+effective_validator_id: "{{ validator_id | default(inventory_hostname) }}"
+# Образ с меткой ревизии, собранный в этом прогоне.
+image_ref: "{{ image_name }}:{{ deploy_rev | default('unknown') }}"