Include profile::boot_security_upgrade in role::bookstack

[akuzminsky]

The prerequisite half for BookStack. Nothing tags these instances yet — the tag comes from website-pod's defer_inspector_findings_until_patched (infrahouse/terraform-aws-website-pod#132), which must not be enabled until this is deployed.

That ordering is the whole point. The tag is fail-open: an instance that launches tagged with nothing to remove it is permanently invisible to Inspector, silently. Puppet leads, Terraform follows.

Also fixes the role's @summary, which said "Puppet role for a jumphost".

Defaults

fail_on_error => false (the default) — the wiki is a long-lived stateful singleton, so an unpatched-but-serving host beats an ABANDONed one. Opposite of github_runner, which passes true because a runner that cannot patch should be replaced.

⚠️ One bookstack-specific factor before the tag gets enabled

BookStack is the first target behind an ALB health check on /login expecting 200 — jumphost and openvpn sit behind NLBs whose TCP checks come up long before the app does. terraform-aws-bookstack sets health_check_grace_period = var.asg_health_check_grace_period, default 600s.

Boot patching adds wall-clock inside that window. The normal path is one apt-get update -qq && unattended-upgrade — tens of seconds. But the budget ceiling is 480s, consumed only under dpkg-lock contention, and the ih-puppet double apply is already several hundred seconds on comparable modules. Worst case could push past the 10-minute grace period and have the ASG replace an instance that was merely still patching.

Two levers if it bites, neither needed to merge this:

• lower the budget for this role via hiera — profile::boot_security_upgrade::budget in bookstack.yaml
• raise asg_health_check_grace_period in terraform-aws-bookstack

Unrelated, but noticed while checking: that variable is described as "minutes" and used both ways — as seconds for health_check_grace_period and as minutes for wait_for_capacity_timeout ("${var.asg_health_check_grace_period * 1.5}m" = 900m = 15h at the default).

Verification

Same tier as #297, and for the same reason. role::bookstack does not compile on a laptop — and does not compile at HEAD either, without this change (exit 1, no output). profile::bookstack::config needs provisioning-time inputs that cannot be stubbed here, so the failure is pre-existing and unrelated. Confirmed by compiling both ways rather than assuming.

Checked instead:

• puppet-lint --fail-on-warnings modules/role — clean
• puppet parser validate — clean
• Neither cloud-guest-utils nor awscli is declared anywhere in profile::bookstack or its sub-manifests — the only plausible duplicate-declaration collision, since the profile declares the first and includes profile::packages for the second

Worth a real check on the first apply, since CI does not compile catalogs.

Sequence from here

1. This merges and deploys
2. website-pod#132 releases
3. terraform-aws-bookstack bumps website-pod, sets defer_inspector_findings_until_patched = true, and adds ec2:DeleteTags via instance_profile_permissions

🤖 Generated with Claude Code

https://claude.ai/code/session_01KLGAXtoyoakLXUjaJSL4M3