Run 500 (this PR's first CI run) failed L0 prod-baremetal-not-dev-surface: act runs steps with umask 0000, the checkout was world-writable, and Ansible (now present, via the toolbox) refuses a world-writable directory as an ansible.cfg source. Reproduced and fixed locally in the pinned image. Co-Authored-By: Claude Opus 5.5 <[email protected]>