apt's autoremove option is not reliably honoured alongside upgrade:, so upgrade.yml now runs it separately. meshfirmware is cloned/updated by the scripts role (as the remote user) from both site.yml and upgrade.yml. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>