feat: add ansible to base cli-tools

Adds ansible + ansible-lint as an always-on base module so it is
available in both identities (private/work) and all contexts.
Disable per host via base.cliTools.ansible.enable = false.

README.md

@@ -161,6 +161,7 @@ Every module in m3ta-home has an `enable` option. Base modules default to `true`
 ### Available Flags
 
 ```
+base.cliTools.ansible.enable     # Ansible (config rollout to servers)
 base.shell.fish.enable          # Fish shell
 base.shell.nushell.enable       # Nushell
 base.shell.starship.enable      # Starship prompt

profiles/base/cli-tools/ansible.nix

@@ -0,0 +1,21 @@
+# Ansible — configuration management for rolling out configurations to servers.
+# Lives in base so it is available in every identity (private/work) and context.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.ansible;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.ansible.enable = (mkEnableOption "enable Ansible configuration management") // {default = true;};
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      ansible
+      ansible-lint
+    ];
+  };
+}

profiles/base/cli-tools/default.nix

@@ -1,6 +1,7 @@
 # CLI tools aggregator — imports all base command-line utilities.
 {...}: {
   imports = [
+    ./ansible.nix
     ./bat.nix
     ./carapace.nix
     ./direnv.nix