v2.1.0 - ansible-core 2.16 fixes and an opt-in pipeline gate

No breaking changes: every entry is additive or a fix, and each new variable
defaults to the 2.0.0 behaviour. schema_version stays 2.0. One fix changes
a type on ansible-core 2.16 only: the comparison's RAM fields were strings
there and are now numbers, as they already were on every newer core (see
Fixed).

Added

• An opt-in fleet health gate can fail a pipeline
  (#41).
  linux_vitals_fail_on_status: any_fail makes the run fail when more hosts
  fail than linux_vitals_fail_threshold_count (default 0);
  regression counts only hosts that went from Pass at baseline to Fail
  in a postcheck. The gate is the last task of vitals_report, so reports,
  archives and notifications are always written first. The default, empty,
  keeps the exit code independent of fleet health, as before. See
  docs/examples.md.
  Thanks @Tiyatrotist.

• Molecule scenarios for Debian 12 and Amazon Linux 2023
  (#105). CI now
  runs six distributions; Debian exercises the reboot-required-file path and
  Amazon Linux the needs-restarting path. Thanks
  @Tiyatrotist.

• Golden-file tests for every scan finding
  (#98).
  Fourteen fixture hosts -- Ubuntu, Rocky, Fedora and openSUSE, each healthy,
  degraded and critical, plus two known-bug cases -- run through the real,
  unmodified vitals_scan tasks, and the per-host result is compared with a
  snapshot in tests/golden/. Every finding the scan can raise from collected
  state fires in at least one fixture. The behaviour changes planned for 2.2
  (#62, #39, #24, #30, #23) will each show up as a golden diff in their pull
  request. The same snapshots pass on ansible-core 2.16 and the
  newest core. No behaviour change; see
  docs/testing.md.

• Report and snapshot permissions are configurable
  (#61).
  linux_vitals_report_file_mode and linux_vitals_report_dir_mode apply to
  generated reports, archives, snapshots, and directories. The existing
  0644/0755 defaults remain unchanged; operators on shared control nodes
  can opt into 0600/0700. Thanks @GreedyC.

• CI now tests the ansible-core floor
  (#47).
  meta/runtime.yml has always declared 2.16, but CI only ever ran the newest
  core, and two total failures on 2.16 (#45, #49) reached users through a
  green build. The validate job (syntax check, ansible-lint, pytest) now also
  runs on ansible-core 2.16 with Python 3.10, and Molecule runs the Rocky
  scenario on it. The floor is pinned by
  .github/constraints/ansible-core-floor.txt, checked against
  meta/runtime.yml by tests/test_ci_floor.py, and documented in
  docs/testing.md.

Changed

• vitals_scan refuses to run in check mode
  (#38). Under
  --check, Ansible skips the discovery probes, so the scan used to fail
  a few tasks later on an undefined fact (object of type 'dict' has no attribute 'services'). It now stops before discovery with one message
  explaining why and saying to run without --check. Check mode never
  worked, so no working run is affected. Thanks
  @Tiyatrotist.

• Set the source checkout's fact cache timeout explicitly to one hour and
  document cache reuse, cold scans, and cleanup of retired hosts
  (#25).

• Document the community.general version constraint needed when installing
  on ansible-core 2.16, and what the Collection community.general does not support Ansible version 2.16.x warning means
  (#86). Thanks
  @rupayon123.

• Build the required-service status map in one shared task for both initial
  scanning and post-healing refresh, preventing the two paths from drifting
  (#28). Thanks
  @rupayon123.

• CI Python tooling installs now require binary wheels with
  --only-binary :all:, preventing dependency source build scripts from
  running during installation
  (#74).

Fixed

• The comparison's RAM fields were strings on ansible-core 2.16.
  comparison.ram_used_pct_before, ram_used_pct_after, and
  ram_used_pct_delta reached report.json as "91.0" on 2.16 -- the
  declared floor -- and as 91.0 on newer cores, so a consumer doing
  arithmetic on the delta got a different type depending on who ran the
  playbook (#81).
  They are now numbers on every core. The test asserts the type as well as the
  value, because on a newer core the value alone would pass either way.

• The generic webhook never sent on ansible-core 2.16, the declared floor,
  in any release since 1.0.0
  (#85). On 2.16
  the template lookup turns JSON-looking output into a dict before
  from_json sees it, and from_json raised on the dict. The error happened
  while templating the arguments of a no_log task, so the operator saw only
  "censored" and never the actionable "Generic webhook notification failed"
  message. The payload is now parsed only when the lookup returns a string,
  and is rendered in its own task outside no_log -- as the Slack payload
  already was -- so a template error is visible. The URL and headers, which
  are the credentials, stay masked. The Slack Block Kit payload used the same
  pattern and gets the same fix; it only worked on 2.16 by accident of its
  content.

  tests/test_core216_compat.py now rejects a template lookup piped straight
  into from_json, since a runtime test passes on any newer core.

Documentation

• CONTRIBUTING.md opens with a short first-pull-request path -- pick a
  labelled issue, run pytest, open the PR, and let CI run Molecule and the
  ansible-core 2.16 suite -- and its stale lint command, role count and
  publishing steps are corrected.
• docs/roadmap.md is replanned to end in January 2027, with 2.2.0 -- Trust
  at the end of November and 2.3.0 -- Coverage at the end of January.

---

Install: ansible-galaxy collection install sameeralam3127.linux_vitals:==2.1.0

Full changelog: https://github.com/sameeralam3127/linux-vitals/blob/v2.1.0/CHANGELOG.md