Critical fixes: trustworthy results, AlmaLinux-correct tests, EL10/perf hardening

[xsub]

Implements the CRITICAL.md triage (C1–C8) plus the highest-value EL10/perf
bugs from the audit (P1–P4). Scoped to defects that produce wrong evidence,
lose evidence, or break the documented -c local default run.

Critical (C1–C8)

• C3 Pin the Ansible stdout callback (ANSIBLE_STDOUT_CALLBACK=default, no color) so a non-default callback can't silently mask failures and report a false passed.
• C7 Add an HCS_RESULT contract with explicit status precedence over the recap heuristic — a tolerated ignored task no longer flips a passing step to failed.
• C6 Catch SIGINT, terminate the child process group, and always write a partial report in finally.
• C4 Default sandbox base /tmp → /var/tmp (tmpfs/reboot loses evidence on long runs).
• C1 containers: install podman (+wget) instead of the absent docker package; fix swapped task names; run_test.sh honors CONTAINER_RUNTIME.
• C2 network: derive LTS/SUT IPs safely and report unsupported on single-host local runs instead of erroring on an undefined SSH_CONNECTION.
• C5 ltp: enable crb/powertools by EL major version.
• C8 New AlmaLinux 9/10 functional CI job: runs --profile check (asserts passed) and single-host --test network (asserts unsupported) — catches role-level regressions beyond syntax checks.

Hardening (P1–P4)

• P4 Throttle the live progress UI to ~10/s (LTP/Phoronix emit thousands of lines); recap/markers still parsed every line.
• P1 Drop redhat-lsb-core from LTP (removed on EL9/10, not needed to build).
• P2 Cap LTP make -j$(nproc) to avoid OOM on high-core hosts.
• P3 Phoronix runs when free space equals the requirement, not only exceeds it.

Testing

• Unit tests 18 → 31 (TDD; new coverage for the callback pin, /var/tmp default, derive_status precedence, HCS_RESULT parsing, graceful-stop report, UI throttle).
• 26 YAML files + 12 shell scripts pass the repo's own validators; hcs compiles; live dry-run verified.

Caveats

ansible-playbook wasn't available locally, so the role/shell edits (C1/C2/C5/P1–P3) are validated by syntax + review. The new C8 job exercises check + network on real AlmaLinux 9/10. Functional containers/ltp runs aren't in CI (nested-container privilege + long compiles) and still rest on review until run on a real SUT.

Test plan

• CI green (unit, YAML, shell, ansible syntax, AlmaLinux functional)
• On a real AlmaLinux 10 SUT: python -m hcs run --preset certification --inventory 127.0.0.1, -c local — containers/ltp/network behave as described