feat(packages): add package management role

Port global-installPackages() and scripts/up2date.sh.

Features:
- Deploy /usr/local/bin/up2date.sh helper for operators
- Install webmin and tailscale apt repositories
- apt dist-upgrade + autoremove (up2date equivalent)
- Remove unwanted packages (systemd-timesyncd, chrony, telnet, etc.)
- Install fleet toolset with platform-aware filtering:
  - Proxmox hosts: skip cockpit/tuned (conflicts with PVE)
  - Kali hosts: skip unavailable packages (latencytop, fonts-powerline)
- Install KVM guest agent on virtual guests
- Install bare-metal power/perf packages on physical AND Proxmox hosts

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

roles/packages/files/up2date.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+# Ansible-managed copy of provisioning/scripts/up2date.sh.
+# Kept as an operator convenience; the packages role performs the same
+# work idempotently via the ansible.builtin.apt module.
+
+echo "Running apt-get update"
+export DEBIAN_FRONTEND="noninteractive" && apt-get -qq --yes update
+
+echo "Running apt-get dist-upgrade"
+export DEBIAN_FRONTEND="noninteractive" && apt-get -qq --yes dist-upgrade
+
+echo "Running apt-get upgrade"
+export DEBIAN_FRONTEND="noninteractive" && apt-get -qq --yes upgrade
+
+echo "Running apt-get purge"
+export DEBIAN_FRONTEND="noninteractive" && apt-get -qq --purge autoremove --yes
+export DEBIAN_FRONTEND="noninteractive" && apt-get -qq autoclean --yes