feat: add present/absent branching for Auftragskatalog roles

Adds a tuxflotte_state variable, threaded from a new
tuxflotte_auftrag_states dict in site.yml (role name -> present/absent,
populated by the agent from the checkin response's "auftraege" list,
see ADR-0010) down into each role via include_role vars. Roles not
present in that dict default to "present" via .get(), so today's
purely workspace-composed, additive-only behavior is unchanged.

Retrofits all three existing placeholder roles with the present/absent
branch as the reference implementation of the convention, and
documents it in the README for future catalog-eligible roles. This is
what makes deselecting an Auftrag actually revert something instead of
just stopping future re-application.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

roles/guest-session/tasks/main.yml

@@ -9,3 +9,10 @@
     dest: /run/tuxflotte/agent/applied/guest-session.marker
     content: "{{ ansible_date_time.iso8601 }}\n"
     mode: "0644"
+  when: tuxflotte_state == "present"
+
+- name: Remove guest-session marker (Auftrag abgewählt)
+  ansible.builtin.file:
+    path: /run/tuxflotte/agent/applied/guest-session.marker
+    state: absent
+  when: tuxflotte_state == "absent"