Add upgrade playbook and wrapper script for apt dist-upgrade on all nodes

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

ansible/upgrade.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Wrapper for upgrade.yml.
+# Usage: ./upgrade.sh [--reboot] [ansible-playbook args, e.g. --limit dm-edworth --ask-become-pass]
+set -euo pipefail
+cd "$(dirname "$0")"
+
+EXTRA=()
+if [[ "${1:-}" == "--reboot" ]]; then
+  EXTRA=(-e reboot=true)
+  shift
+fi
+
+exec ansible-playbook upgrade.yml "${EXTRA[@]}" "$@"