[Spike] Add explicit Noah role provisioning

[vivekr-splunk]

Review stack

Order	Repository	Change	Status
1	splunk-ansible	This PR: explicit Noah provisioning and role behavior	Current
2	docker-splunk	splunk/docker-splunk#733: consume the exact Ansible commit through the normal build path	Depends on this PR

Why

The Phase 0 image proved the required Noah behavior, but the implementation was hidden behind a Docker overlay that replaced selected Ansible files. This PR puts the provisioning behavior in splunk-ansible so reviewers can follow the supported flow directly.

Noah is an explicit mode layered on the existing splunk.role. A [noahService] stanza by itself does not activate Noah-specific behavior, which keeps classic Cluster Manager deployments on their existing path.

Role contract

Splunk role	Noah behavior	Heartbeats	Peer and bucket-map discovery
splunk_indexer	Peer	Enabled	Disabled
splunk_search_head	Search client	Disabled	Enabled
splunk_deployer	None	Disabled	Disabled

Unsupported roles fail with a clear validation error when Noah mode is enabled.

Lifecycle flow

1. SPLUNK_NOAH_ENABLED=true explicitly selects Noah provisioning.
2. Before the temporary authentication splunkd starts, pre_auth.yml writes a complete but disabled [noahService] stanza, a parseable role-specific heartbeat, and an available symmetric key.
3. The existing declarative configuration renders normally.
4. Before the full splunkd start, post_config.yml selects exactly one indexer, search-head, or deployer profile.
5. Search-head bootstrap settings are written before startup; Noah-only convergence waits and retry windows are gated so classic SHC behavior remains unchanged.
6. The existing Restart the splunkd service notification remains valid. Noah CLI restarts use a bounded stop/start path; classic mode retains the original restart command.

Scope

• Adds the composable splunk_noah role and explicit environment mapping.
• Adds stable Kubernetes advertised-address derivation for Noah indexers.
• Adds role-specific indexer, search-head, and deployer configuration.
• Adds focused contract and inventory tests plus reviewer-facing role documentation.
• Does not contain SOK controller code, Docker overlays, images, credentials, account IDs, or the separate Go provisioner experiment.

Validation

• 14 focused Noah tests pass.
• Inventory default and environment mapping tests pass.
• Ansible syntax check passes.
• Direct Ansible role execution passes for indexer, search-head, and deployer profiles.
• Unsupported-role execution fails with the expected diagnostic.
• Full small suite: 582 passed, 5 skipped, and 13 pre-existing splunk_secret expectation failures. The same 13 failures reproduce on clean origin/develop (569 passed, 5 skipped).
• git diff --check passes and the diff was scanned for credentials/account identifiers.

This is a spike PR and remains draft while the linked Docker image is rebuilt and validated end to end.