Add web-ffsh firmware release role with publish/promote workflow script

[Copilot]

This adds an Ansible-managed release helper for firmware publishing on web-ffsh, covering staged release deployment (testing/rc) and explicit promotion to stable with version-change guardrails.

• Scope and deployment target

  • Introduces a new firmware_release role and wires it into the services play.
  • Role self-skips unless inventory_hostname == web-ffsh, so the helper is only installed on the intended host.

• Release publish workflow (/root/firmware-release.sh publish [tag])

  • Defaults to latest GitHub release; supports explicit tag input.
  • Fetches release metadata and downloads archive assets.
  • Merges split archive parts, extracts content into safe space, and removes archive artifacts immediately after use.
  • Rebuilds stage links as requested:
    • testing -> extracted safe-space content
    • rc -> testing
  • Enforces safety cleanup for testing, rc, and stable paths when they are not valid symlinks into safe space.

• Stable promotion workflow (/root/firmware-release.sh promote)

  • Promotes testing content to stable by replacing previous stable and moving staged content.
  • Preserves requested link topology after promotion (testing and rc aligned to promoted stable state).
  • Always prompts for confirmation.
  • Adds extra confirmation when major/minor version changes are detected (patch/extra digit ignored), using persisted .release-version metadata from publish.

• Role defaults and operability

  • Adds configurable defaults for repo owner/name, firmware root, safe space, target host, and script path.
  • Installs required runtime tools (curl, jq, archive utilities) for deterministic script execution.

Example usage:

# publish latest
/root/firmware-release.sh publish

# publish specific tag
/root/firmware-release.sh publish v2025.1.2.0

# promote testing to stable (interactive confirmations)
/root/firmware-release.sh promote

• Fixes add script that automates the release publishing process #50