itg into the inventory: the bootstrap chicken-and-egg, the three Fedora
assumptions that are false on Debian (no sudo at all, visudo not on a
non-login PATH, %sudo instead of %wheel and it wants a password), the
subscription nag with the assert that keeps it honest, and an explicit note
on what was left out and why.
Also the two Ansible warnings that had been printing on every fleet run:
pipelining off means -tt means a pty means a stray CR after the JSON, and
why interpreter_python=auto_silent rather than pinning the interpreter in
group_vars/all.
