Share the Molecule scaffolding and add just molecule

Three things that would not have scaled to 70 roles:

- The Python and Ansible dependency pins were about to be copied into every
  role. They now live once in molecule-shared/, which scenarios reference
  relatively, so they cannot drift apart.
- The helper container images used for probing were hardcoded inline. They
  are pinned once in molecule-shared/vars.yml, carry `# renovate:`
  annotations, and a custom manager in .github/renovate.json keeps them
  current - verified with a local Renovate dry run, which offers
  curl 8.11.1 -> 8.21.0 and python 3.13 -> 3.14-alpine. Seventy invisible
  hardcodes is the blindness class we have been removing elsewhere.
- Running a scenario meant knowing the venv and cd incantation. `just
  molecule <role>` does it, and with no argument lists the roles that have
  a scenario.

Molecule is deliberately not wired into prek: a run takes minutes, pulls
images and needs Docker, which is fine on request and not fine per commit.

docs/molecule-testing.md covers how to run and write these, including the
four things a role here needs that a standalone role does not. AGENTS.md
points at it rather than carrying the detail.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

molecule-shared/requirements.txt

@@ -0,0 +1,4 @@
+ansible==14.1.0
+molecule==26.6.0
+molecule-plugins==26.7.8
+docker==7.2.0

molecule-shared/requirements.txt.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Slavi Pantaleev
+
+SPDX-License-Identifier: AGPL-3.0-or-later

molecule-shared/requirements.yml

@@ -0,0 +1,23 @@
+---
+# Shared by every role scenario under roles/custom/*/molecule/, referenced from
+# each scenario's molecule.yml. Kept in one place so the pins cannot drift
+# apart across roles.
+roles:
+  - name: ansible-role-docker
+    src: https://github.com/geerlingguy/ansible-role-docker
+    scm: git
+    version: 8.0.0
+
+  - name: com.devture.ansible.role.playbook_help
+    src: https://github.com/devture/com.devture.ansible.role.playbook_help
+    scm: git
+    version: main
+
+  - name: com.devture.ansible.role.systemd_docker_base
+    src: https://github.com/devture/com.devture.ansible.role.systemd_docker_base
+    scm: git
+    version: v1.5.0-0
+
+collections:
+  - name: community.docker
+    version: 5.2.2

molecule-shared/requirements.yml.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Slavi Pantaleev
+
+SPDX-License-Identifier: AGPL-3.0-or-later

molecule-shared/vars.yml

@@ -0,0 +1,16 @@
+---
+# Helper container images the scenarios use for probing. They live here rather
+# than inline in each verify.yml so that there is one pin per image instead of
+# one per role, and so Renovate can see them (see the customManager in
+# .github/renovate.json).
+
+# Used to reach a role's container over its own container network. A helper is
+# needed because the role publishes no host port - exactly as in a real
+# deployment - and publishing one for the test would collide between scenarios
+# running in parallel.
+# renovate: datasource=docker depName=docker.io/curlimages/curl
+molecule_shared_image_curl: "docker.io/curlimages/curl:8.11.1"
+
+# Used for small stub services (a fake homeserver, and so on).
+# renovate: datasource=docker depName=docker.io/library/python
+molecule_shared_image_python: "docker.io/library/python:3.13-alpine"

molecule-shared/vars.yml.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Slavi Pantaleev
+
+SPDX-License-Identifier: AGPL-3.0-or-later