fix(#442): deprecate ad-hoc recovery scripts; add ansible structure tests

- Add DEPRECATION headers to overlapping ad-hoc recovery scripts:
  - config_drift.py, config_drift_detector.py → golden_state role
  - self_healing.py → deadman_switch role
  - reset_pipeline_state.py → agent_startup playbook
  - provision_wizard.py → site.yml + wizard_base role
  - cron_audit.py, cron-audit-662.py → cron_manager role

- Add tests/test_ansible_structure.py (19 pytest checks) validating
  the complete canonical ansible/ structure required by #442

- Update docs/CANONICAL_SERVICES.md with explicit supersession table
  mapping each ad-hoc mechanism to its Ansible replacement

- ansible/README.md: document webhook setup as required step

This establishes ansible/ as the single canonical source of truth
for fleet lifecycle management and formally retires the overlapping
ad-hoc recovery mechanisms.

Closes #442

scripts/config_drift.py

@@ -1,3 +1,21 @@
+#!/usr/bin/env python3
+"""
+config_drift.py — DEPRECATED
+
+Config drift detection and sync is handled by Ansible golden_state role; ad-hoc manual sync bypasses PR review.
+
+Superseded by: ansible/playbooks/golden_state.yml + ansible/roles/golden_state
+
+DO NOT USE. Use the Ansible canonical playbook instead:
+  ansible-playbook -i ansible/inventory/hosts.yml ansible/playbooks/golden_state.yml
+
+This script remains only for historical reference. It will be removed after
+fleet-wide migration is verified (issue timmy-config #442).
+
+Issue: timmy-config #442 — [P2] Ansible IaC — Canonical Playbook for Fleet Management
+Deprecated: 2026-04-29 (STEP35 FREE BURN)
+"""
+
 #!/usr/bin/env python3
 """
 config_drift.py — Detect configuration drift across fleet nodes.