chore: add .gitignore, ansible.cfg and include playbook/ (without vault)

.gitignore

@@ -0,0 +1,13 @@
+# Ansible artifacts
+*.retry
+
+# Sensitive group vars
+playbook/group_vars/vault.yml
+
+# Local facts/cache
+.ansible/
+.ansible_facts_cache/
+
+# Editor/OS
+.DS_Store
+*.swp

README.md

@@ -1,2 +1,7 @@
 # os-upgrade-automation
 
+
+## Structure
+- playbook/ (roles, vars, inventories)
+- group_vars/vault.yml excluded (use sops/age)
+

ansible.cfg

@@ -0,0 +1,9 @@
+[defaults]
+inventory = playbook/inventories
+roles_path = playbook/roles
+retry_files_enabled = False
+stdout_callback = yaml
+host_key_checking = False
+force_color = True
+forks = 10
+callback_whitelist = profile_tasks