Use ansible_facts[] instead of injected top-level facts

[kennedydane]

Why

The uv lock --upgrade in this branch bumps ansible-core 2.20.4 → 2.21.2, which tags every top-level injected fact with a deprecation warning:

[DEPRECATION WARNING] INJECT_FACTS_AS_VARS default to `True` is deprecated,
top-level facts will not be auto injected after the change.
Origin: ansible/roles/compiled/tasks/common/R.yaml:20:16

The setting itself isn't marked deprecated in config/base.yml — the warning comes from ansible/vars/manager.py:51-56 at templating time, which is why it only surfaced after the upgrade.

Injection is removed in ansible-core 2.24. At that point all 189 bare references here silently resolve to undefined and every build breaks. Better to migrate now than find out mid-deploy.

What changed

189 references across 69 files → ansible_facts['name']:

Fact	Count
ansible_env	89
ansible_processor_vcpus	63
ansible_processor_count	5
ansible_architecture	1

Includes the two .def templates (RStudio.def, bcbio.def) that neither linter parses, and the ~30 commented-out occurrences — those are the copy-paste source for new task files.

Magic and connection vars (ansible_run_tags, ansible_connection, ansible_python_interpreter) are not facts and are untouched.

Enforcement

ansible-lint 26.6.0 has no rule for this — I checked all 52; deprecated-bare-vars is unrelated (it targets bare with_items values), and nothing in our skip_list was hiding it. So the fix carries its own guard:

• ansible.cfg: inject_facts_as_vars = False — a missed reference now fails loudly at runtime instead of resolving to the wrong value. Revertible by one line.
• .github/workflows/lint.yml: grep step gating reintroduction at PR time, covering the .def/.sh/.lua/.j2 templates neither linter looks at.
• add-software/SKILL.md documented the deprecated form and would have reintroduced it in every new package. Fixed, plus a CLAUDE.md convention bullet.

Verification

• Completeness grep → clean
• yamllint → clean; ansible-lint → 0 failure(s), 0 warning(s) in 439 files, production profile passed
• Live playbook run: all four facts resolve; both ansible_env shapes work (attribute access and in guard, hit and miss); zero deprecation warnings; ansible_processor_vcpus is defined is now false, confirming injection is genuinely off rather than just quiet
• Second run through the actual environment: keyword (which debug wouldn't exercise): MAKEFLAGS=[-j 10], PATH prepend intact

Not done: a full compile of a real package. The inventory is local and deploys are manual, so I didn't want to build software on a live host unprompted. The environment: test covers the templating gap; worth one real build before merging if you want belt-and-braces.

Also in this PR

uv.lock (ansible 13.5.0 → 14.2.0, ansible-core 2.20.4 → 2.21.2, ansible-lint 26.3.0 → 26.6.0) — it's the reason for the change, so it belongs here.

Follow-up, not this PR

.ansible-lint skips meta-no-info, which no longer appears in ansible-lint -L after the version bump — likely inert now, worth pruning separately.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SVQzRA7FchcYjuJRMrCL93

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[kennedydane]

@MikeCTZA Nothing to see in this one.