fix(sys-hostname): guarantee *.localhost loopback resolution on every target

The guide matrix rolled debian, whose image ships neither libnss_myhostname nor a myhostname nsswitch entry, so *.infinito.localhost fell through to DNS, coredns only knows the outer stack's domain, and hlth-webserver died on NXDOMAIN; arch passed because its base enables nss-myhostname out of the box. Install libnss-myhostname on the Debian family and append myhostname to the nsswitch hosts line idempotently, also inside containers - mirroring the host-mode guide fix. Probed across all five CI distros: fedora/centos/arch already resolve out of the box (both tasks no-op), debian/ubuntu gain exactly the missing pieces.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

roles/sys-hostname/tasks/01_core.yml

@@ -23,4 +23,19 @@
         create: true
   when: not DOCKER_IN_CONTAINER | bool
 
+- name: ✅ Ensure nss-myhostname is installed so *.localhost resolves to loopback
+  become: true
+  ansible.builtin.package:
+    name: libnss-myhostname
+    state: present
+  when: ansible_facts.os_family == 'Debian'
+
+- name: ✅ Ensure nsswitch resolves hosts via myhostname
+  become: true
+  ansible.builtin.lineinfile:
+    path: /etc/nsswitch.conf
+    regexp: "^(hosts:(?!.*\\bmyhostname\\b).*)$"
+    line: "\\1 myhostname"
+    backrefs: true
+
 - include_tasks: utils/once/flag.yml