fix(ansible): workstation install script + Makefile target for local Macs

ansible_become_ask_pass in group_vars does not reliably trigger an
interactive sudo prompt for ansible_connection=local — Ansible cannot
prompt per-host mid-play. The fix is a wrapper script that passes
-K / --ask-become-pass before any play execution.

- infrastructure/bin/install_workstation.sh: auto-detects FQDN, adds
  --ask-become-pass, passes extra args through. Run from repo root:
    ./infrastructure/bin/install_workstation.sh
    make workstation
- Makefile: add 'workstation' target pointing to the script
- group_vars/workstations.yml: drop ansible_become_ask_pass (does not
  work), keep ansible_pipelining=false (needed for SSH workstations
  with sudo passwords — pipelining replaces stdin, breaking sudo -S)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Makefile

@@ -19,7 +19,8 @@ KNOE_AUTH_VERSION ?= latest
 DEPLOYMENT_REPO_URL ?= http://gitea.local/knoe/deployment.git
 
 .PHONY: all knoe build build-auth docker-build-auth docker-push-auth install deploy init clean help requirements test pyconv start \
-        k3d-knoe-up k3d-knoe-pf k3d-knoe-down
+        k3d-knoe-up k3d-knoe-pf k3d-knoe-down \
+        workstation
 
 all: build
 
@@ -36,6 +37,7 @@ help:
 	@echo "  deploy       - Run infrastructure deployment via deploy.sh"
 	@echo "  build        - Build the 'knoe' CLI binary"
 	@echo "  build-auth   - Build the knoe-auth Spring Boot jar (authority/pom.xml)"
+	@echo "  workstation  - Configure Kerberos + Chrome SPNEGO on this machine"
 	@echo "  requirements - Install Python dependencies"
 	@echo "  test         - Run full test suite"
 	@echo "  pyconv       - Check Python code style conventions (black)"
@@ -100,6 +102,11 @@ deploy:
 	@echo "Running Knoe deployment..."
 	./deploy.sh
 
+workstation:
+	@echo "Configuring Kerberos + Chrome SPNEGO on this machine..."
+	@echo "(You will be prompted for your sudo password)"
+	@bash infrastructure/bin/install_workstation.sh
+
 test: pyconv
 	@echo "Running full test suite..."
 	@./tests/run_tests.sh

infrastructure/bin/install_workstation.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# install_workstation.sh — configure Kerberos + browser SPNEGO on this machine.
+#
+# Wraps workstation_kerberos.yml and adds --ask-become-pass (-K) automatically,
+# since personal Macs require a sudo password and ansible_become_ask_pass in
+# group_vars does not reliably trigger an interactive prompt for local connections.
+#
+# Usage:
+#   ./infrastructure/bin/install_workstation.sh            # auto-detects hostname
+#   ./infrastructure/bin/install_workstation.sh morgana.prole.org
+#   ./infrastructure/bin/install_workstation.sh zinfandel.prole.org
+#   ./infrastructure/bin/install_workstation.sh --check    # dry-run
+#
+# Any extra arguments are passed through to ansible-playbook.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
+cd "${REPO_ROOT}"
+
+# Auto-detect the FQDN — works on both macOS and Linux.
+HOST="${1:-}"
+EXTRA_ARGS=()
+
+if [[ -z "${HOST}" || "${HOST}" == --* ]]; then
+    # No host given (or first arg is a flag) — detect FQDN automatically.
+    HOST="$(hostname -f 2>/dev/null || hostname)"
+    # If the auto-detected hostname isn't in inventory, try appending .prole.org
+    if ! grep -q "^${HOST}" infrastructure/inventory/hosts.ini 2>/dev/null; then
+        HOST="${HOST%%.*}.prole.org"
+    fi
+    # Put any leading flag back into extra args
+    [[ "${1:-}" == --* ]] && EXTRA_ARGS=("$@")
+else
+    shift
+    EXTRA_ARGS=("$@")
+fi
+
+echo "Target: ${HOST}"
+echo "Vault:  ${REPO_ROOT}/.vault_pass"
+echo ""
+
+exec ansible-playbook \
+    infrastructure/playbooks/workstation_kerberos.yml \
+    --limit "${HOST}" \
+    --ask-become-pass \
+    "${EXTRA_ARGS[@]}"

infrastructure/inventory/group_vars/workstations.yml

@@ -1,13 +1,14 @@
 # Workstation-specific Ansible connection overrides.
 #
-# Servers (k3s nodes, VMs) run passwordless sudo and have pipelining=True
-# in ansible.cfg for performance. Personal Macs/Linux workstations:
-#   1. Require a sudo password (become_ask_pass: true)
-#   2. Cannot use SSH pipelining with password-based sudo — pipelining
-#      replaces stdin with a pipe, which sudo interprets as a non-interactive
-#      session and refuses to prompt for a password.
+# Servers (k3s nodes, VMs) have pipelining=True in ansible.cfg for performance.
+# Personal Macs/Linux workstations need pipelining disabled: pipelining replaces
+# stdin with a pipe, which prevents sudo from prompting for a password
+# (sudo -S reads the password from stdin; if that's a pipe, sudo sees EOF and
+# falls back to "sudo: a password is required").
 #
-# ansible_become_ask_pass applies to macOS/Linux (ssh + local connections).
-# It is silently ignored for Windows WinRM targets in workstations_windows.
-ansible_become_ask_pass: true
+# Note: ansible_become_ask_pass in inventory does NOT reliably trigger an
+# interactive terminal prompt for local connections. Use the wrapper script
+# instead:
+#   ./infrastructure/bin/install_workstation.sh
+# which adds --ask-become-pass (-K) automatically.
 ansible_pipelining: false