Finish simplifying the Seriatim role

README.md

@@ -2,7 +2,8 @@
 
 Installs [Seriatim](https://gitea.maximumdirect.net/eric/seriatim) from source
 on Ubuntu 26.04 (`x86_64` or `aarch64`). The role requires gathered facts and
-privilege escalation for its default paths and dependency installation.
+uses privilege escalation on tasks that install dependencies or manage
+root-owned application state.
 
 ## Variables
 
@@ -13,18 +14,21 @@ seriatim_source_dir: /usr/local/src/seriatim
 seriatim_binary_path: /usr/local/bin/seriatim
 seriatim_manage_build_dependencies: true
 seriatim_go_snap_channel: 1.26/stable
+seriatim_go_binary: /snap/bin/go
 ```
 
-When `seriatim_manage_build_dependencies` is `false`, Git and `/snap/bin/go`
-must already be available. Otherwise, the role installs Git with APT and the
-classic Go Snap from `seriatim_go_snap_channel`.
+When `seriatim_manage_build_dependencies` is `false`, Git and the executable
+selected by `seriatim_go_binary` must already be available. Otherwise, the role
+installs Git with APT and the classic Go Snap from
+`seriatim_go_snap_channel`.
 
 The checkout is authoritative: local source changes are discarded while
 selecting `seriatim_version`. The role builds `./cmd/seriatim` directly to
-`seriatim_binary_path` using `/snap/bin/go`, `CGO_ENABLED=0`, `GOWORK=off`,
+`seriatim_binary_path` using `seriatim_go_binary`, `CGO_ENABLED=0`, `GOWORK=off`,
 `GOTOOLCHAIN=local`, `-trimpath`, and release linker metadata. It rebuilds when
-the checkout changes, the binary is absent, or `seriatim --version` does not
-exactly match the selected version.
+the checkout changes or the binary is absent. Exact version output is verified
+by the repository-local integration suite rather than during production
+convergence.
 
 The source tree is recursively owned by `root:root`. The installed binary is a
 regular file owned by `root:root` with mode `0755`.
@@ -33,7 +37,6 @@ regular file owned by `root:root` with mode `0755`.
 
 ```yaml
 - hosts: seriatim_hosts
-  become: true
   roles:
     - role: ansible-role-seriatim
 ```
@@ -42,12 +45,12 @@ regular file owned by `root:root` with mode `0755`.
 
 The integration driver installs pinned collection dependencies, runs syntax
 checking and ansible-lint, and verifies the default release and idempotence. It
-also covers missing and wrong-version binaries, metadata drift without a
-rebuild, selection of the previous release, restoration of the default
-release, and platform failures before application state is created. The suite
-mutates only `/usr/local/src/seriatim`, `/usr/local/bin/seriatim`, and paths
-inside its private temporary directory, and leaves the default release
-installed:
+also covers a missing binary, a caller-supplied Go executable with dependency
+management disabled, metadata drift without a build, selection of the previous
+release, restoration of the default release, and platform failures before
+application state is created. The suite mutates only
+`/usr/local/src/seriatim`, `/usr/local/bin/seriatim`, and paths inside its
+private temporary directory, and leaves the default release installed:
 
 ```sh
 tests/integration