fix(api): install ansible runtime for truth chain

apps/api/tests/test_awooop_truth_chain_service.py

@@ -706,6 +706,46 @@ def test_ansible_runtime_readiness_reports_check_mode_blockers() -> None:
     assert readiness["playbook_count"] >= 1
     assert isinstance(readiness["can_run_check_mode"], bool)
     assert isinstance(readiness["blockers"], list)
+    assert "repair_ssh_key_readable" in readiness
+    assert "repair_known_hosts_readable" in readiness
+
+
+def test_ansible_runtime_readiness_requires_repair_ssh_material(tmp_path: Path) -> None:
+    missing_key = tmp_path / "missing-id-ed25519"
+    missing_known_hosts = tmp_path / "missing-known-hosts"
+
+    readiness = _ansible_runtime_readiness(
+        repair_ssh_key_path=missing_key,
+        repair_known_hosts_path=missing_known_hosts,
+    )
+
+    assert readiness["repair_ssh_key_present"] is False
+    assert readiness["repair_ssh_key_readable"] is False
+    assert readiness["repair_known_hosts_present"] is False
+    assert readiness["repair_known_hosts_readable"] is False
+    assert "ansible_repair_ssh_key_missing" in readiness["blockers"]
+    assert "ansible_repair_known_hosts_missing" in readiness["blockers"]
+
+
+def test_ansible_runtime_readiness_accepts_readable_repair_ssh_material(tmp_path: Path) -> None:
+    key_path = tmp_path / "id_ed25519"
+    known_hosts_path = tmp_path / "known_hosts"
+    key_path.write_text("test-key", encoding="utf-8")
+    known_hosts_path.write_text("192.168.0.110 ssh-ed25519 AAAATEST", encoding="utf-8")
+    key_path.chmod(0o400)
+    known_hosts_path.chmod(0o400)
+
+    readiness = _ansible_runtime_readiness(
+        repair_ssh_key_path=key_path,
+        repair_known_hosts_path=known_hosts_path,
+    )
+
+    assert readiness["repair_ssh_key_present"] is True
+    assert readiness["repair_ssh_key_readable"] is True
+    assert readiness["repair_known_hosts_present"] is True
+    assert readiness["repair_known_hosts_readable"] is True
+    assert "ansible_repair_ssh_key_missing" not in readiness["blockers"]
+    assert "ansible_repair_known_hosts_missing" not in readiness["blockers"]
 
 
 def test_ansible_playbook_roots_supports_flat_container_module_path() -> None: