ci: add ansible-lint workflow and fix all lint findings

[popstas]

Summary

Two related things:

1. Add an ansible-lint CI job and fix every finding. The release workflow's Import to Ansible Galaxy step runs ansible-lint and was reporting 215 findings. The role now meets the ansible-lint production profile (0 failures, 0 warnings), enforced on every push/PR.
2. Fix the Galaxy namespace drift that was the actual cause of the release import failure (legacy namespace viasite does not exist).

Namespace fix (Option C)

meta/main.yml had drifted to namespace: viasite, but the role has always been published as viasite-ansible.zsh (Galaxy role id 29998), and install.sh / README.md reference that name. The mismatch:

• broke the Galaxy import (viasite namespace doesn't exist), and
• forced playbook.yml / molecule converge.yml to viasite.zsh, which then broke install.sh (role is symlinked as viasite-ansible.zsh => role 'viasite.zsh' was not found).

Aligned everything to the real namespace: meta namespace: viasite-ansible, and playbook.yml / converge.yml back to viasite-ansible.zsh. ansible-lint still passes — the self-reference resolves via namespace.role_name.

Lint changes

New CI + config

• .github/workflows/lint.yml — run ansible-lint on push / PR / dispatch
• .ansible-lint — exclude .github/, .venv/, windows/; skip only yaml[line-length] (long templated URLs / one-line ternaries in vars/)
• .gitignore — ignore the .ansible lint cache

Fixes

• FQCN for all builtin modules; yes/no -> true/false; quote/comment/comma/jinja spacing (ansible-lint --fix)
• Named all include_tasks and molecule/playbook plays
• mode: "0644" on copy/template tasks (risky-file-permissions)
• set -o pipefail + executable: /bin/bash on piped shells (risky-shell-pipe)
• Kept tar for starship extract (BSD-tar on macOS) with # noqa + changed_when
• meta/main.yml: MacOSX platform versions -> all (schema)

Auto-quoting verified value-preserving (e.g. '\e[1~' -> "\\e[1~"); no keybinding/behavior changes.

Verification checklist

• lint workflow green
• molecule scenarios pass: default / shared / user / starship
• install.sh (ubuntu + macos) pass — role resolves as viasite-ansible.zsh
• Next tagged release: Galaxy import succeeds under viasite-ansible

Note: getting a shorter viasite.* namespace instead would require owning a viasite GitHub org or a Galaxy-admin namespace grant (Options A/B, out of scope here).

🤖 Generated with Claude Code