feat(roles): pull custom roles from inventory-declared sources

An inventory group web-app-cst-<name> with applications.<id>.custom: true and
a pinned source {url, version, path} is pulled into roles/ before the play,
read raw (Jinja, Ansible tags and credential URLs refused), placed through a
staging directory under an exclusive lock, and owned by a marker that names
its own directory, so a pull or roles-clean never replaces or removes a
directory it did not place and a failed pull leaves roles/ as it was.
Directory inventories, host lists and non-UTF-8 files behave as Ansible
reads them; generated test deploys pass --skip-pull. make roles-pull,
roles-clean and roles list, INFINITO_EXTRA_MOUNTS for local sources, the
web-app-cst category, the reserved prefix lint and a central
repository_files() that also yields the gitignored custom roles let every
lint scan them like in-tree roles. Supersedes the uncommitted 045 External
Roles draft and reuses its fetch, sync and mount design.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/unit/python/cli/administration/deploy/development/deploy/test_run.py

@@ -0,0 +1,34 @@
+from __future__ import annotations
+
+import unittest
+from types import SimpleNamespace
+from unittest import mock
+
+from cli.administration.deploy.development.deploy.run import _run_deploy
+
+
+class TestRunDeploy(unittest.TestCase):
+    def deploy_cmd(self) -> list[str]:
+        compose = mock.Mock()
+        compose.exec.return_value = SimpleNamespace(returncode=0)
+        _run_deploy(
+            compose,
+            deploy_ids=["web-app-cst-demo"],
+            debug=False,
+            passthrough=[],
+            inventory_dir="/etc/inventories/dev",
+            container_name="infinito",
+        )
+        return compose.exec.call_args.args[0]
+
+    def test_deploys_the_generated_inventory(self):
+        cmd = self.deploy_cmd()
+        self.assertEqual("/etc/inventories/dev/devices.yml", cmd[3])
+        self.assertEqual(["--id", "web-app-cst-demo"], cmd[-2:])
+
+    def test_generated_inventory_keeps_the_placed_custom_roles(self):
+        self.assertIn("--skip-pull", self.deploy_cmd())
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/python/cli/administration/deploy/development/test_env_compose_file_args.py

@@ -8,7 +8,9 @@ because an unsatisfied `:?` guard inside one of them aborts the whole stack.
 from __future__ import annotations
 
 import os
+import tempfile
 import unittest
+from pathlib import Path
 from unittest.mock import patch
 
 from cli.administration.deploy.development.env import compose_file_args
@@ -23,6 +25,7 @@ _LOCAL_PRIMARY = {
     "INFINITO_CACHE_STACK": "",
     "INFINITO_GHCR_MIRROR": "",
     "INFINITO_PUBLISH_PORTS": "",
+    "INFINITO_EXTRA_MOUNTS": "",
 }
 
 _WORKTREE = {
@@ -99,6 +102,35 @@ class TestComposeFileArgs(unittest.TestCase):
             compose_file_args()[-2:], ["-f", "compose/noports.override.yml"]
         )
 
+    def test_extra_mounts_append_their_generated_override(self) -> None:
+        with (
+            tempfile.TemporaryDirectory() as mount,
+            patch.dict(
+                os.environ,
+                {**_LOCAL_PRIMARY, "INFINITO_EXTRA_MOUNTS": mount},
+                clear=False,
+            ),
+            patch(
+                "cli.administration.deploy.development.extra_mounts.write_mounts_override",
+                return_value="build/compose/extra-mounts.override.yml",
+            ) as write,
+        ):
+            args = compose_file_args()
+            self.assertEqual(write.call_args.args[1], [Path(mount)])
+        self.assertEqual(args[-2:], ["-f", "build/compose/extra-mounts.override.yml"])
+
+    def test_an_entry_that_is_no_directory_stops_the_stack_naming_it(self) -> None:
+        with (
+            patch.dict(
+                os.environ,
+                {**_LOCAL_PRIMARY, "INFINITO_EXTRA_MOUNTS": "/nonexistent/gui"},
+                clear=False,
+            ),
+            self.assertRaises(SystemExit) as ctx,
+        ):
+            compose_file_args()
+        self.assertIn("/nonexistent/gui", str(ctx.exception.code))
+
 
 if __name__ == "__main__":  # pragma: no cover
     unittest.main()

tests/unit/python/cli/administration/deploy/development/test_extra_mounts.py

@@ -0,0 +1,65 @@
+from __future__ import annotations
+
+import tempfile
+import unittest
+from pathlib import Path
+
+from cli.administration.deploy.development.extra_mounts import (
+    OVERRIDE,
+    parse_mounts,
+    write_mounts_override,
+)
+from utils.cache.yaml import load_yaml
+
+
+class TestParseMounts(unittest.TestCase):
+    def test_existing_absolute_directories_are_returned(self) -> None:
+        with (
+            tempfile.TemporaryDirectory() as first,
+            tempfile.TemporaryDirectory() as second,
+        ):
+            self.assertEqual(
+                parse_mounts(f"{first}, {second},"), [Path(first), Path(second)]
+            )
+
+    def test_empty_value_mounts_nothing(self) -> None:
+        self.assertEqual(parse_mounts(""), [])
+
+    def test_relative_entry_is_rejected_naming_it(self) -> None:
+        with self.assertRaises(SystemExit) as ctx:
+            parse_mounts("relative/dir")
+        self.assertIn("relative/dir", str(ctx.exception.code))
+
+    def test_missing_directory_is_rejected_naming_it(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp, self.assertRaises(SystemExit) as ctx:
+            parse_mounts(str(Path(tmp) / "absent"))
+        self.assertIn("absent", str(ctx.exception.code))
+
+
+class TestWriteMountsOverride(unittest.TestCase):
+    def test_each_directory_is_bound_read_only_at_its_own_path(self) -> None:
+        with tempfile.TemporaryDirectory() as repo:
+            relative = write_mounts_override(Path(repo), [Path("/srv/gui")])
+            override = load_yaml(Path(repo) / relative)
+        self.assertEqual(relative, OVERRIDE)
+        self.assertEqual(
+            override,
+            {
+                "services": {
+                    "infinito": {
+                        "volumes": [
+                            {
+                                "type": "bind",
+                                "source": "/srv/gui",
+                                "target": "/srv/gui",
+                                "read_only": True,
+                            }
+                        ]
+                    }
+                }
+            },
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()