fix(agent): add unprivileged nginx preflight

apps/api/src/services/awooop_ansible_audit_service.py

@@ -116,6 +116,7 @@ _CATALOG: tuple[dict[str, Any], ...] = (
     {
         "catalog_id": "ansible:nginx-sync",
         "playbook_path": "infra/ansible/playbooks/nginx-sync.yml",
+        "check_mode_playbook_path": "infra/ansible/playbooks/nginx-sync-readonly.yml",
         "inventory_hosts": ["host_110", "host_188"],
         "domains": ["nginx", "proxy", "ollama_proxy", "tls"],
         "keywords": ["nginx", "proxy", "ollama", "gcp", "tls", "cert", "502", "upstream"],

apps/api/tests/test_awooop_truth_chain_service.py

@@ -1294,6 +1294,9 @@ def test_ansible_truth_keeps_catalog_hint_separate_from_runtime_use() -> None:
     assert truth["records"] == []
     assert truth["not_used_reason"].startswith("no automation_operation_log row")
     assert truth["candidate_catalog"]["candidates"][0]["catalog_id"] == "ansible:nginx-sync"
+    assert truth["candidate_catalog"]["candidates"][0]["check_mode_playbook_path"] == (
+        "infra/ansible/playbooks/nginx-sync-readonly.yml"
+    )
     assert truth["candidate_catalog"]["candidates"][0]["approval_required"] is False
     assert truth["candidate_catalog"]["decision_effect"] == "none"