feat: define Seriatim role contract

tasks/validate.yml

@@ -0,0 +1,38 @@
+---
+- name: Verify the managed host is supported
+  ansible.builtin.assert:
+    that:
+      - ansible_facts.distribution == 'Ubuntu'
+      - ansible_facts.distribution_version is version('26.04', '==')
+      - ansible_facts.architecture in ['x86_64', 'aarch64']
+    fail_msg: >-
+      Seriatim supports Ubuntu 26.04 on x86_64 and aarch64; detected
+      {{ ansible_facts.distribution }} {{ ansible_facts.distribution_version }}
+      on {{ ansible_facts.architecture }}.
+
+- name: Verify required Seriatim values are nonempty
+  ansible.builtin.assert:
+    that:
+      - seriatim_version | length > 0
+      - seriatim_repository_url | length > 0
+      - seriatim_source_ref | length > 0
+      - seriatim_build_version | length > 0
+      - seriatim_go_snap_channel | length > 0
+      - seriatim_go_binary | length > 0
+      - seriatim_go_build_flags | length > 0
+      - seriatim_go_build_flags | select('equalto', '') | list | length == 0
+      - seriatim_go_ldflags | length > 0
+      - seriatim_go_package | length > 0
+      - seriatim_build_version is not regex('.*\\s+.*')
+    fail_msg: Seriatim repository, revision, build, and Go values must be nonempty, and the build version cannot contain whitespace.
+
+- name: Verify managed Seriatim paths are safe and distinct
+  ansible.builtin.assert:
+    that:
+      - seriatim_source_dir is match('^/')
+      - seriatim_binary_path is match('^/')
+      - seriatim_build_state_dir is match('^/')
+      - seriatim_source_dir != seriatim_binary_path
+      - seriatim_source_dir != seriatim_build_state_dir
+      - seriatim_binary_path != seriatim_build_state_dir
+    fail_msg: Seriatim source, binary, and state paths must be absolute and pairwise distinct.