ci: harden template build pipeline and expand rust test coverage

[l50]

Key Changes:

• Introduced a reusable Docker Buildx composite action with BuildKit image pull retries to survive transient Docker Hub failures across all workflows
• Added aggressive runner disk cleanup and cache tolerance so the large GPU template image builds no longer fail with "no space left on device"
• Removed the entire Molecule test workflow and added a scheduled template build with automatic failure issue reporting
• Expanded Rust unit test coverage for config resolution, host dedup logic, and loot snapshot normalization

Added:

• Reusable Buildx setup action - Created .github/actions/setup-buildx/action.yml that retries BuildKit image pulls up to 5 times before failing, replacing scattered inline docker/setup-buildx-action usage
• Scheduled template rebuilds - Added a weekly cron trigger and Rust source path filters (ares-cli, ares-core, ares-llm, ares-tools, Cargo.toml, Cargo.lock) to build-and-push-templates.yaml so template images rebuild when the baked ares binary changes
• Automated failure reporting - Added a report-failure job that opens or updates a GitHub issue when template builds fail on main
• Manual PR title validation - Added a workflow_dispatch path to semantic-prs.yaml for validating conventional-commit titles on demand
• Renovate cargo-llvm-cov tracking - Added a regex manager to keep CARGO_LLVM_COV_VERSION in workflows up to date, pinned via new CARGO_LLVM_COV_VERSION env in rust.yaml
• Proxmox placeholder env vars - Added Proxmox configuration placeholders to validate-templates.yaml
• Extensive Rust tests - Added config path resolution, shipped-config validation, and set_model behavior tests in ares-cli/src/config.rs; host dedup tests in ops/loot/format/hosts.rs; and loot snapshot normalization tests in ops/loot/snapshot.rs

Changed:

• Runner disk cleanup - Expanded the "Free up disk space" step to strip additional preinstalled toolchains, prune Docker images, and clean apt caches to reclaim ~25GB for GPU image builds
• Buildx cache resilience - Added ignore-error=true to registry --cache-to exports so cache push failures don't fail builds
• Renovate automerge strategy - Switched from branch-based to PR-based automerge and removed :automergeBranch preset
• Pre-commit workflow - Added a retrying prefetch step for remote Taskfile includes and skip Rust hooks (cargo-fmt, cargo-clippy, cargo-check, cargo-test) since they run in the dedicated Rust workflow, trimming ~11 minutes
• Release artifact handling - Made release.yaml fail loudly when an expected release binary is missing instead of silently skipping
• Renovate fork processing - Enabled RENOVATE_FORK_PROCESSING so renovate processes forks
• Clippy scope - Extended clippy to --all-targets in rust.yaml
• Semgrep SARIF upload - Set continue-on-error: true so SARIF upload failures don't block the workflow
• Template detection - Updated test-template-builds.yaml to scan warpgate-templates/templates/, pull in templates affected by ansible playbook changes, build without pushing, and reference the ghcr.io/l50/* registry
• Action version bumps - Upgraded setup-python to v7.0.0, setup-go to v7, upload-artifact to v7.0.1, action-gh-release to v3.0.2, renovatebot/github-action to v46.2.1, and taiki-e/install-action across workflows

Removed:

• Molecule test workflow - Deleted .github/workflows/molecule.yaml and its role change detection, matrix generation, and per-role test jobs

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.50%. Comparing base (02b5943) to head (d7ca872).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #440      +/-   ##
==========================================
- Coverage   81.33%   80.50%   -0.84%     
==========================================
  Files         476      460      -16     
  Lines      170395   161591    -8804     
==========================================
- Hits       138589   130084    -8505     
+ Misses      31806    31507     -299     

Files with missing lines	Coverage Δ
ares-cli/src/config.rs	93.35% <100.00%> (+57.75%)	⬆️
ares-cli/src/ops/loot/format/hosts.rs	98.25% <100.00%> (+27.06%)	⬆️
ares-cli/src/ops/loot/snapshot.rs	78.73% <100.00%> (+78.73%)	⬆️

... and 16 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[l50]

@mwendigg reminder to land this