fix: correct Goss test suite to match actual server state

Fixes found by running make verify against Railiance01:

- Fix playbook_dir paths (ansible/playbooks/ is 2 levels from repo root)
- age/sops are binary installs, not apt packages — use command checks
- Admin user is tegwick, not admin; sudoers at /etc/sudoers.d/tegwick
- sudo granted via sudoers file, not group membership — remove group assert
- Ubuntu 24.04 socket-activates SSH; assert ssh.socket not ssh.service
- SSH hardening lives in sshd_config.d/10-hardening.conf, not main config
- UFW SSH rule uses app name "OpenSSH", not port 22/tcp
- Replace /regex/i patterns with plain strings (Goss file.contents)
- Update spec/server-baseline.yaml to match all findings

All 27 assertions now pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

goss/baseline.yaml

@@ -15,10 +15,8 @@ package:
     installed: true
   htop:
     installed: true
-  age:
-    installed: true
-  sops:
-    installed: true
+
+# age and sops are binary installs, not apt packages — checked via command below
 
 service:
   ufw:
@@ -27,23 +25,24 @@ service:
   fail2ban:
     enabled: true
     running: true
-  ssh:
+  # Ubuntu 24.04 uses socket activation: ssh.service is disabled by design,
+  # ssh.socket keeps it running. Assert the socket is enabled.
+  ssh.socket:
     enabled: true
     running: true
 
 file:
-  /etc/ssh/sshd_config:
+  /etc/ssh/sshd_config.d/10-hardening.conf:
     exists: true
-    contains:
-      - /^PermitRootLogin no/i
-      - /^PasswordAuthentication no/i
-      - /^PubkeyAuthentication yes/i
+    contents:
+      - "PermitRootLogin no"
+      - "PasswordAuthentication no"
+      - "PubkeyAuthentication yes"
 
 user:
-  admin:
+  tegwick:
     exists: true
-    groups:
-      - sudo
+    # sudo access is via /etc/sudoers.d/tegwick (NOPASSWD), not group membership
     shell: /bin/bash
 
 command:
@@ -51,10 +50,10 @@ command:
     exit-status: 0
     stdout:
       - "Status: active"
-      - /22\/tcp.*ALLOW/
+      - /OpenSSH.*ALLOW/
       - /6443\/tcp.*ALLOW/
       - /8472\/udp.*ALLOW/
-  "grep NOPASSWD /etc/sudoers.d/admin":
+  "grep NOPASSWD /etc/sudoers.d/tegwick":
     exit-status: 0
     stdout:
       - "NOPASSWD"
@@ -66,3 +65,7 @@ command:
     exit-status: 0
     stdout:
       - "Status for the jail: sshd"
+  "test -x /usr/local/bin/age":
+    exit-status: 0
+  "test -x /usr/local/bin/sops":
+    exit-status: 0