feat(security): add Wazuh agent role

Port Modules/Security/secharden-wazuh.sh.

Installs the Wazuh agent from the official apt repository with the
configured manager address. The agent package is held to prevent
uncontrolled upgrades. Skipped entirely on the Wazuh server host
(tsys-nsm) via the wazuh_server inventory group.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

roles/security_wazuh/tasks/main.yml

@@ -0,0 +1,81 @@
+---
+# Wazuh agent — port of Modules/Security/secharden-wazuh.sh.
+# Skipped entirely on the wazuh server itself (legacy TSYS_NSM_CHECK).
+# Uses the is_wazuh_server fact set by preflight based on the 'wazuh_server'
+# inventory group.
+
+- name: Skip agent install on the Wazuh server
+  ansible.builtin.debug:
+    msg: "Skipping wazuh-agent install on the wazuh server ({{ inventory_hostname }})."
+  when: is_wazuh_server | bool
+
+- name: Install wazuh-agent (non-server hosts)
+  when: not (is_wazuh_server | bool)
+  block:
+    - name: Remove any stale wazuh keyring
+      ansible.builtin.file:
+        path: /usr/share/keyrings/wazuh.gpg
+        state: absent
+
+    - name: Create keyring directory
+      ansible.builtin.file:
+        path: /usr/share/keyrings
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Fetch Wazuh GPG key
+      ansible.builtin.get_url:
+        url: https://packages.wazuh.com/key/GPG-KEY-WAZUH
+        dest: /tmp/GPG-KEY-WAZUH
+        mode: "0644"
+      changed_when: false
+
+    - name: Import Wazuh GPG key into keyring
+      ansible.builtin.command: >-
+        gpg --no-default-keyring
+        --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg
+        --import /tmp/GPG-KEY-WAZUH
+      args:
+        creates: /usr/share/keyrings/wazuh.gpg
+
+    - name: Clean up GPG key temp file
+      ansible.builtin.file:
+        path: /tmp/GPG-KEY-WAZUH
+        state: absent
+
+    - name: Set keyring permissions
+      ansible.builtin.file:
+        path: /usr/share/keyrings/wazuh.gpg
+        mode: "0644"
+        owner: root
+        group: root
+
+    - name: Add Wazuh apt repository
+      ansible.builtin.apt_repository:
+        repo: "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main"
+        filename: wazuh
+        state: present
+        update_cache: true
+
+    - name: Install wazuh-agent
+      ansible.builtin.apt:
+        name: wazuh-agent
+        state: present
+        update_cache: false
+      environment:
+        WAZUH_MANAGER: "{{ wazuh_manager }}"
+
+    - name: Hold wazuh-agent package (prevent uncontrolled upgrades)
+      ansible.builtin.dpkg_selections:
+        name: wazuh-agent
+        selection: hold
+
+    - name: Enable and start wazuh-agent
+      ansible.builtin.systemd:
+        name: wazuh-agent
+        enabled: true
+        state: started
+        daemon_reload: true
+      failed_when: false