Run apt autoremove as its own task and manage meshfirmware via Ansible

apt's autoremove option is not reliably honoured alongside upgrade:, so
upgrade.yml now runs it separately. meshfirmware is cloned/updated by the
scripts role (as the remote user) from both site.yml and upgrade.yml.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

ansible/roles/scripts/tasks/main.yml

@@ -16,3 +16,6 @@
     group: "{{ remote_user }}"
     mode: "0755"
   become: false
+
+- name: Clone/update meshfirmware
+  ansible.builtin.import_tasks: meshfirmware.yml