Shared host baseline
The host_baseline role manages state shared by the Production and Testing
environments on ghostnet-ki.
Its first version deliberately has a narrow scope:
- refuse changes when hostname, Debian major version or primary IPv4 address do not match the declared target;
- require at least 100 GiB free on the root filesystem; and
- create root-owned parent directories and the future shared-data root.
Environment-specific directory ownership is managed by workload_accounts so
the shared baseline and workload identities do not compete over permissions.
It does not install packages, drivers, Podman or applications and does not start or stop services. Ownership below the directory roots will be assigned to dedicated service accounts when the corresponding application roles are implemented.