Decide whether real deploys should use Ansible pipelining too

[thiras]

Open decision left by #50, which enabled ANSIBLE_PIPELINING for the molecule scenarios only.

ansible/ansible.cfg sets no pipelining, so after #50 the test suite and a real make deploy use different Ansible transports: the suite streams modules over stdin, production stages a remote temp file.

What this does and does not mean

It is tempting to call this a coverage regression — it mostly isn't, and the calibration matters:

• With pipelining on, command/shell modules are fed over stdin, so the remote-tmp path behind become_user is not exercised. The role has two such tasks: decdn key-gen (ansible/roles/decdn_node/tasks/main.yml:1192-1201) and the decdn config validate gate (:1444-1460).
• But molecule connects as root, where handing the temp file to an unprivileged user is a plain chown. The ACL path the role warns about (:1489, "needs the acl package on this host") was therefore never reproduced by this suite, before or after perf(molecule): run scenarios in parallel, enable pipelining #50.

So no real coverage was lost. What remains is the divergence itself: prod runs a path the tests never take.

#50 already closed the sharper half of this by adding acl to baseline_packages, so hosts provisioned by site.yml are no longer exposed to the footgun the role documents.

The question

Set pipelining = True in ansible/ansible.cfg so test and prod match — and real deploys get the same speedup the suite did (−22% of per-task overhead) — or leave deploys on the default transport deliberately, and keep the divergence documented?

Argument for: fewer transports to reason about, faster deploys, and acl is now installed anyway.
Argument against: it changes behaviour on real hosts, which is a bigger blast radius than a test-only knob, and deploy speed has never been the complaint.

The coverage boundary is documented at ansible/molecule/default/molecule.yml in the meantime.

[thiras]

Decided in favour: pipelining = True is now set in ansible/ansible.cfg (landed in #63, cb90b20). So real deploys and the molecule suite use the same transport. The deciding reason was security, not speed. Without pipelining, the copy: content=… args for decdn.env and grafana-alloy.env (plaintext secrets) are staged in ~/.ansible/tmp on the target, and no_log doesn't cover that file.