Fix ansible-lint failures and code review sticky comments (#14885)

* Fix ansible-lint failures and improve linting configuration

This PR eliminates all ansible-lint failures (9 → 0) and reduces warnings
(25 → 20). The remaining warnings are yaml[line-length] which are
intentionally in the warn_list.

Changes:

1. GitHub workflow YAML compliance
   - Add document start markers (---)
   - Quote 'on:' key (YAML truthy value)

2. Replace ignore_errors with failed_when
   - privacy/clear_history.yml: Use failed_when: false instead of
     ignore_errors for tasks that may fail on clean systems

3. Use apt module instead of shell
   - privacy/auto_cleanup.yml: Replace apt-get shell command with
     proper apt module (autoclean: true)

4. Add changed_when to handlers and tasks
   - Handlers always run due to notifications, so changed_when: false
     is appropriate for read-only operations
   - Check commands that only read state get changed_when: false
   - Reboot task gets changed_when: true (it actually changes state)

5. Configure ansible-lint for project structure
   - Exclude CloudFormation templates (roles/cloud-*/files/) which use
     AWS-specific YAML tags (!Equals, !GetAtt) that ansible-lint
     cannot parse
   - Add mock_modules for custom modules in library/ directory that
     ansible-lint cannot auto-discover during static analysis
     See: https://github.com/ansible/ansible-lint/discussions/1353

6. Fix Jinja2 spacing
   - Remove extraneous whitespace in multi-line Jinja expressions
   - Fix spacing before closing parentheses

References:
- ansible-lint mock_modules: https://ansible.readthedocs.io/projects/lint/configuring/
- Custom module discovery issue: https://github.com/ansible/ansible-lint/discussions/1353
- Ansible local modules: https://docs.ansible.com/ansible/latest/dev_guide/developing_locally.html

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Workaround sticky comment bug in claude-code-action

The use_sticky_comment feature is broken in claude-code-action v1.
This adds instructions for Claude to minimize its old comments as
OUTDATED before posting new reviews, preventing comment clutter.

Also adds gh api to allowed tools for the GraphQL mutation.

See: https://github.com/anthropics/claude-code-action/issues/419

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

.github/workflows/claude-code-review.yml

@@ -1,6 +1,7 @@
+---
 name: Claude Code Review
 
-on:
+'on':
   pull_request:
     types: [opened, synchronize]
     # Optional: Only run on specific file changes
@@ -41,7 +42,13 @@ jobs:
             REPO: ${{ github.repository }}
             PR NUMBER: ${{ github.event.pull_request.number }}
 
-            Please review this pull request and provide feedback on:
+            IMPORTANT: Before posting your review, minimize any previous review comments from yourself to avoid cluttering the PR:
+            1. List existing comments: gh api repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments
+            2. Find comments from "github-actions[bot]" that contain "Code Review" or review-related content in the body
+            3. For each such comment, minimize it as OUTDATED using:
+               gh api graphql -f query='mutation($id: ID!) { minimizeComment(input: {subjectId: $id, classifier: OUTDATED}) { minimizedComment { isMinimized } } }' -f id="<node_id>"
+
+            Then review this pull request and provide feedback on:
             - Code quality and best practices
             - Potential bugs or issues
             - Performance considerations
@@ -54,4 +61,6 @@ jobs:
 
           # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
           # or https://docs.claude.com/en/docs/claude-code/cli-reference for available options
-          claude_args: '--allowed-tools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*),Bash(ansible-playbook * --syntax-check),Bash(ansible-lint *),Bash(ruff check *),Bash(yamllint *),Bash(shellcheck *),Bash(python -m pytest *)"'
+          # Note: gh api is needed for minimizing old comments (workaround for broken use_sticky_comment)
+          # See: https://github.com/anthropics/claude-code-action/issues/419
+          claude_args: '--allowed-tools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*),Bash(gh api:*),Bash(ansible-playbook * --syntax-check),Bash(ansible-lint *),Bash(ruff check *),Bash(yamllint *),Bash(shellcheck *),Bash(python -m pytest *)"'

.github/workflows/claude.yml

@@ -1,6 +1,7 @@
+---
 name: Claude Code
 
-on:
+'on':
   issue_comment:
     types: [created]
   pull_request_review_comment: