Finish the Audita remediation

README.md

@@ -52,9 +52,12 @@ modes, executable behavior, and native configuration validation. It covers
 missing-binary and checkout rebuilds, caller-supplied Go with dependency
 management disabled, metadata repair without rebuilding, configuration-only
 convergence, and platform failures before isolated application state exists.
-The suite mutates only `/usr/local/src/audita`, `/usr/local/bin/audita`,
-`/usr/local/etc/audita/config.yml`, and paths inside its private temporary
-directory, then leaves the default release and configuration installed:
+On a fresh host, default convergence may also install Git through APT, refresh
+the APT cache, and install the Go Snap. Application state is limited to
+`/usr/local/src/audita`, `/usr/local/bin/audita`, and
+`/usr/local/etc/audita/config.yml`; temporary test-specific files remain inside
+the suite's private temporary directory. The suite leaves the default release
+and configuration installed:
 
 ```sh
 tests/integration

meta/main.yml

@@ -4,7 +4,7 @@ galaxy_info:
   namespace: rakestraw
   author: Eric Rakestraw
   description: Install and configure Audita from source
-  license: BSD-3-Clause
+  license: CC0-1.0
   min_ansible_version: "2.18"
   issue_tracker_url: https://gitea.maximumdirect.net/eric/ansible-role-audita/issues
   platforms:

tests/verify.yml

@@ -50,6 +50,7 @@
     - name: Check binary metadata
       ansible.builtin.assert:
         that:
+          - audita_binary_metadata.stat.isreg
           - audita_binary_metadata.stat.pw_name == "root"
           - audita_binary_metadata.stat.gr_name == "root"
           - audita_binary_metadata.stat.mode == "0755"