Reconcile the pupmod baseline templates with the deployed fleet and re-assert it (#88)

[silug]

Closes #88. Rebased onto the #43 branch (create-release-tag-workflow), so it merges cleanly once #43 lands.

Updates the puppetsync templates to match what is actually deployed on the fleet's master branches, so the first blanket apply_puppet_role session since the OpenVox migration re-asserts the baseline instead of reverting it. The original draft reconciled against the openvox9-ruby4-preview branches; those changes have since become master reality, and the workflow hunks of the original draft (pr_tests, tag_deploy, release_rpms) were superseded by #58 and #44 — the rebase drops them.

What's left, verified against a fresh audit of all 70 pupmod masters:

1. Gemfile — the OpenVox-era baseline (openvox/openvox-strings, voxpupuli-test stack via simp-rake-helpers ~> 6.0, no puppet/pdk/puppetlabs_spec_helper, rubocop pins removed). Matches the 27-repo majority except a template-side comment. Bootstrap-strategy, so existing repos are untouched (Renovate + merge_gemfile manage them); this is what new repos start from.
2. spec_helper.rb.epp — the voxpupuli-test variant; renders byte-identically to the 20-repo majority. The other variants are stragglers of the same migration (one manifest_dir line, heredoc style) that the sync will normalize.
3. Dotfile reconciliation (the Enforce-strategy templates are behind the deployed fleet; apply_puppet_role would revert fleet improvements (spec_helper.rb, .gitignore, ...) #88 fixes):
   • _gitignore: the 66-repo majority (AI-assistant ignores, etc.) plus aide's two fixes — the !/spec/fixtures/hieradata/ directory re-include that makes the file-level re-include actually work, and /Gemfile.local (a documented override file). aide was ahead of the majority here, not behind.
   • _pdkignore: /AGENTS.md (62-repo majority).
   • _puppet-lint.rc: adopt --no-strict_indent-check fleet-wide — strict_indent 5.0.0 crashes puppet-lint on some valid manifests and 16 repos already carry the workaround; enforcing the majority would have broken their Puppet Style jobs. Commented for removal when fixed upstream.
   • .gitattributes, .rspec, and the triage-project workflow already match the fleet; untouched.
4. PUPPET_VERSION unpinned-era fix in the four non-pupmod tag_deploy variants (rubygem/github-only), carried over from the original draft.
5. Session config 20260813-baseline-refresh.yaml (now latest) — the blanket apply_puppet_role session. Expected diffs per repo: spec_helper normalization, the puppet-lint flag, gitignore/pdkignore for the handful off-majority, plus create_release_tag.yml bootstrap on any repo whose Add create_release_tag.yml for pupmod repos as a thin caller of simp/gha-workflows (#85 pilot) #43-rollout PR hasn't merged yet.

Verified: 212 rspec + 20 BoltSpec examples green (merge_gemfile specs updated for the new template); managed-file contract passes; local e2e apply against acpid/aide/crypto_policy produces exactly the expected per-repo diffs — and aide (whose .gitignore is the best deployed variant) comes through untouched.

🤖 Generated with Claude Code

[hcaballero2]

Verified this locally by applying the baseline to the deployed fleet and checking for no-ops: a 3-stage puppetsync session (install_gems → checkout → apply_puppet_role, nothing pushed) over 70 pupmods checked out at their deployed state — 64 at openvox9-ruby4-preview plus 6 that have merged the preview to master since this PR was written (the branch count has moved from the 71 in the description). All 70 catalogs compiled and the spec_helper EPP rendered cleanly (byte-identical in 20 repos), and the checkable consensus numbers hit exactly: 26 Gemfiles identical, 27 observer removals, 23 repos matching the majority pr_tests.yml. Every remaining diff falls into a divergence class already documented here, except the items below.

Finding	Count	Note
tag_deploy.yml step name: fleet still says Build Puppet module (PDK)	60/70	The label-drop is now the minority variant (looks like the post-7/13 PUPPET_VERSION fix wave kept the old name). Keep the drop (next sync renames the step in 60 repos) or re-add the label? Only open question.
.gitignore / .pdkignore / .gitattributes drift	11 / 8 / 1	These templates aren't touched by this PR, but "fleet still matches" no longer holds — worth adding to the known-divergences list for the next sync.
Gemfile comment-wording drift	~20	Cosmetic only (rubocop-performance comment text).

Also hit two pre-existing repo bugs while testing, both unrelated to this PR: role::pupmod still includes the deleted profile::pupmod::gitlab_ci (breaks catalog compile when apply_puppet_role is enabled) and summarize_repos_pipeline_results.pp crashes on a missing format::colorize function. Will address in separate PR