feat(roles): pull custom roles from inventory-declared sources

An inventory group web-app-cst-<name> with applications.<id>.custom: true and
a pinned source {url, version, path} is pulled into roles/ before the play,
read raw (Jinja, Ansible tags and credential URLs refused), placed through a
staging directory under an exclusive lock, and owned by a marker that names
its own directory, so a pull or roles-clean never replaces or removes a
directory it did not place and a failed pull leaves roles/ as it was.
Directory inventories, host lists and non-UTF-8 files behave as Ansible
reads them; generated test deploys pass --skip-pull. make roles-pull,
roles-clean and roles list, INFINITO_EXTRA_MOUNTS for local sources, the
web-app-cst category, the reserved prefix lint and a central
repository_files() that also yields the gitignored custom roles let every
lint scan them like in-tree roles. Supersedes the uncommitted 045 External
Roles draft and reuses its fetch, sync and mount design.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/unit/python/cli/administration/deploy/development/deploy/test_run.py

@@ -0,0 +1,34 @@
+from __future__ import annotations
+
+import unittest
+from types import SimpleNamespace
+from unittest import mock
+
+from cli.administration.deploy.development.deploy.run import _run_deploy
+
+
+class TestRunDeploy(unittest.TestCase):
+    def deploy_cmd(self) -> list[str]:
+        compose = mock.Mock()
+        compose.exec.return_value = SimpleNamespace(returncode=0)
+        _run_deploy(
+            compose,
+            deploy_ids=["web-app-cst-demo"],
+            debug=False,
+            passthrough=[],
+            inventory_dir="/etc/inventories/dev",
+            container_name="infinito",
+        )
+        return compose.exec.call_args.args[0]
+
+    def test_deploys_the_generated_inventory(self):
+        cmd = self.deploy_cmd()
+        self.assertEqual("/etc/inventories/dev/devices.yml", cmd[3])
+        self.assertEqual(["--id", "web-app-cst-demo"], cmd[-2:])
+
+    def test_generated_inventory_keeps_the_placed_custom_roles(self):
+        self.assertIn("--skip-pull", self.deploy_cmd())
+
+
+if __name__ == "__main__":
+    unittest.main()