Run apt autoremove as its own task and manage meshfirmware via Ansible

apt's autoremove option is not reliably honoured alongside upgrade:, so
upgrade.yml now runs it separately. meshfirmware is cloned/updated by the
scripts role (as the remote user) from both site.yml and upgrade.yml.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

ansible/roles/scripts/tasks/main.yml

@@ -16,3 +16,6 @@
     group: "{{ remote_user }}"
     mode: "0755"
   become: false
+
+- name: Clone/update meshfirmware
+  ansible.builtin.import_tasks: meshfirmware.yml

ansible/roles/scripts/tasks/meshfirmware.yml

@@ -0,0 +1,8 @@
+---
+- name: Clone/update meshfirmware
+  ansible.builtin.git:
+    repo: https://github.com/mikecarper/meshfirmware.git
+    dest: "/home/{{ remote_user }}/meshfirmware"
+    version: main
+    update: true
+  become: false

ansible/upgrade.yml

@@ -13,8 +13,17 @@
       ansible.builtin.apt:
         update_cache: true
         upgrade: dist
+
+    # Separate task: apt's autoremove option is not reliably honoured together with upgrade:
+    - name: apt autoremove
+      ansible.builtin.apt:
         autoremove: true
 
+    - name: Update meshfirmware
+      ansible.builtin.import_role:
+        name: scripts
+        tasks_from: meshfirmware
+
     - name: Check whether a reboot is required
       ansible.builtin.stat:
         path: /var/run/reboot-required