feat: add present/absent branching for Auftragskatalog roles

Adds a tuxflotte_state variable, threaded from a new
tuxflotte_auftrag_states dict in site.yml (role name -> present/absent,
populated by the agent from the checkin response's "auftraege" list,
see ADR-0010) down into each role via include_role vars. Roles not
present in that dict default to "present" via .get(), so today's
purely workspace-composed, additive-only behavior is unchanged.

Retrofits all three existing placeholder roles with the present/absent
branch as the reference implementation of the convention, and
documents it in the README for future catalog-eligible roles. This is
what makes deselecting an Auftrag actually revert something instead of
just stopping future re-application.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

site.yml

@@ -1,21 +1,33 @@
 - hosts: localhost
   connection: local
   become: true
+  vars:
+    # Vom Agenten per --extra-vars gesetzt (siehe ADR-0010, provisioning-server
+    # Check-in-Response "auftraege"): Rollenname -> "present"/"absent". Rollen,
+    # die hier nicht auftauchen (z.B. weil sie nur workspace-komponiert sind),
+    # bleiben beim Default "present" - unverändert additives Verhalten.
+    tuxflotte_auftrag_states: {}
   tasks:
     - include_role:
         name: guest-session
         apply:
           tags: guest-session
+      vars:
+        tuxflotte_state: "{{ tuxflotte_auftrag_states.get('guest-session', 'present') }}"
       tags: guest-session
 
     - include_role:
         name: brave-fedora
         apply:
           tags: brave-fedora
+      vars:
+        tuxflotte_state: "{{ tuxflotte_auftrag_states.get('brave-fedora', 'present') }}"
       tags: brave-fedora
 
     - include_role:
         name: onlyoffice-fedora
         apply:
           tags: onlyoffice-fedora
+      vars:
+        tuxflotte_state: "{{ tuxflotte_auftrag_states.get('onlyoffice-fedora', 'present') }}"
       tags: onlyoffice-fedora