Add deliberate update playbook and unattended-upgrades role

Regular playbooks now use state: present, so they no longer upgrade
packages as a side effect. This adds two separate, explicit mechanisms
to keep the fleet patched instead:

- update-packages.yml: ad hoc / to-be-scheduled fleet-wide upgrade
  (safe by default, dist available via -e), plus
  update-packages-pinned-example.yml as a template for pinning or
  bumping a single package outside that.
- roles/unattended_upgrades: automatic security-only patching via
  unattended-upgrades, with a scheduled reboot window and mail
  left disabled pending a configured MTA. Applied to every host in
  full.yml and server.yml.

Also removes a leftover `upgrade: yes` apt task from pi_standard_setup
and server_basic_environment that was still doing a full upgrade on
every routine run, defeating the point of the state: present switch.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

update-packages-pinned-example.yml

@@ -0,0 +1,29 @@
+---
+# Template, not run on any schedule. Copy this when a package needs a
+# controlled bump outside update-packages.yml — e.g. a security fix you
+# want before the next scheduled run, or a version you deliberately don't
+# want update-packages.yml's `safe` upgrade to move past.
+#
+# Run explicitly against the hosts that need it:
+#   venv/bin/ansible-playbook update-packages-pinned-example.yml --limit <host>
+
+- name: Pin a package to an exact version
+  hosts: all
+  tasks:
+    - name: Install nginx pinned to a specific version
+      ansible.builtin.apt:
+        name: "nginx=1.18.0-6.1+deb11u3"
+        state: present
+        update_cache: true
+      # Pinning like this also protects the package from update-packages.yml's
+      # `safe`/`dist` upgrade: apt won't move a pinned-by-version install
+      # past the given version on a plain upgrade.
+
+- name: Bump a single named package to latest, deliberately
+  hosts: all
+  tasks:
+    - name: Upgrade openssl to latest available
+      ansible.builtin.apt:
+        name: openssl
+        state: latest # noqa: package-latest - deliberate, scoped to one named package, run ad hoc
+        update_cache: true