fix(security): use broker Python for Wazuh self-test

apps/api/src/services/awooop_ansible_audit_service.py

@@ -535,7 +535,7 @@ _CATALOG: tuple[dict[str, Any], ...] = (
         "auto_apply_enabled": True,
         "approval_required": False,
         "risk_level": "high",
-        "catalog_revision": "2026-07-15-wazuh-alert-ingress-v1",
+        "catalog_revision": "2026-07-15-wazuh-alert-ingress-v2",
     },
     {
         "catalog_id": "ansible:110-host-pressure-readonly",

apps/api/tests/test_wazuh_alertmanager_integration.py

@@ -153,7 +153,14 @@ def test_wazuh_integration_catalog_and_rollback_contract_are_bounded() -> None:
     assert catalog["auto_apply_enabled"] is True
     assert catalog["approval_required"] is False
     assert catalog["supports_check_mode"] is True
+    assert catalog["catalog_revision"] == "2026-07-15-wazuh-alert-ingress-v2"
     assert playbook[0]["hosts"] == "host_112"
+    self_test_task = playbook[0]["tasks"][0]
+    assert self_test_task["delegate_to"] == "localhost"
+    assert self_test_task["become"] is False
+    assert self_test_task["ansible.builtin.command"]["argv"][0] == (
+        "{{ ansible_playbook_python }}"
+    )
     assert "backup: true" in text
     assert "remote_src: true" in text
     assert "wazuh_privileged_convergence_capability_missing" in text

infra/ansible/playbooks/wazuh-alertmanager-integration.yml

@@ -18,7 +18,7 @@
     - name: Verify the repo-owned integration asset before host mutation
       ansible.builtin.command:
         argv:
-          - /usr/bin/python3
+          - "{{ ansible_playbook_python }}"
           - "{{ wazuh_integration_src }}"
           - --self-test
       delegate_to: localhost