Run apt autoremove as its own task and manage meshfirmware via Ansible

apt's autoremove option is not reliably honoured alongside upgrade:, so
upgrade.yml now runs it separately. meshfirmware is cloned/updated by the
scripts role (as the remote user) from both site.yml and upgrade.yml.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

ansible/roles/scripts/tasks/meshfirmware.yml

@@ -0,0 +1,8 @@
+---
+- name: Clone/update meshfirmware
+  ansible.builtin.git:
+    repo: https://github.com/mikecarper/meshfirmware.git
+    dest: "/home/{{ remote_user }}/meshfirmware"
+    version: main
+    update: true
+  become: false