tech-debt(install.sh+ansible): audit ALL apt_repository sites for noble-conflict pattern (#7144 follow-up) #7218

Context

#7144 fixed the Ansible PPA conflict in `install.sh` (deadsnakes + ansible/ansible only). Same root cause vector exists in 8 other apt_repository sites in Ansible roles:

```
roles/agent_config/tasks/openvino.yml:13
roles/redis/tasks/main.yml:36 (#7178 already pinned to jammy fallback)
roles/slm_manager/tasks/grafana.yml:20
roles/docker/tasks/main.yml:73
roles/monitoring/tasks/grafana.yml:50
roles/postgresql/tasks/install.yml:51
roles/python312/tasks/main.yml:29 (also adds deadsnakes — overlaps install.sh)
roles/slm_manager/tasks/main.yml:66 (also adds ansible/ansible — overlaps install.sh)
```

Any host that ships these PPAs pre-configured (in deb822 `.sources` format) will hit the same Signed-By conflict that broke DGX Spark install.

Composability opportunity

Extract `add_ppa_if_missing` from `install.sh` (lines 116-141) into a shared Ansible task at `roles/_shared/tasks/add_ppa_if_missing.yml`. All 8 sites become include_tasks calls with vars. Single point of change for PPA-add semantics.

Acceptance criteria

• Shared task `roles/_shared/tasks/add_ppa_if_missing.yml` created with same idempotent semantics as install.sh helper (detect existing → preserve, sweep stale duplicates)
• All 8 `apt_repository` sites refactored to include the shared task
• No regression on jammy/Hyper-V install
• Behavioural test in CI (similar to install.sh's bash test scaffold)

Reproduced on

DGX Spark — install.sh got past Phase 2 but Ansible-driven PPA additions in slm_manager role might have the same risk for users on noble images that pre-ship Grafana/PG.