headscale: the ACL was {} in code and real on the box. Put it in git

`Create ACL policies file` wrote this, verbatim, to /etc/headscale/acl.json:

    content: |
      {}

An empty policy. The real rules - who may reach which host on which port -
were maintained by hand on spacey and existed nowhere else. So the repo and
the box disagreed about the single file that governs every machine's access
to every other machine, and the repo's version was "nothing is allowed".

It had already fired once. /etc/headscale/acl.json.937464.2026-09-12@14:03:08~
is Ansible's own backup of a 1596-byte policy it replaced with {} on 12 Sep;
the live file is dated 17 Sep, so somebody rebuilt it by hand afterwards
without the playbook ever being corrected. Every subsequent `site.yml` run was
one command away from flattening the whole tailnet's access rules again.

This commit changes nothing on spacey. The policy now lives in
templates/acl.json.j2, captured verbatim from the live file, and the task is a
`template:` instead of an inline `{}`. Rendering it produces sha256
1ed14e7247d957db5e9f8d4f4c53846dc646131ad900054c868483a9a84ed8fd, byte for byte
the file that was already there - verified before applying, and again after.

Three deliberate choices:

- A template file, not the inline `content:` used elsewhere in this playbook.
  The whole failure was three invisible characters passing review; a 2KB
  policy needs to show up as a diff.
- `validate: python3 -m json.tool %s`. headscale refuses to load a malformed
  policy, and a policy it will not load is the same outage as an empty one.
- `"counter-net@"` is now `"{{ headscale_namespace }}@"`, which is already a
  fact in group_vars/all/main.yml rather than a fourteenth hand-typed copy.

The header comment records why a node with no ACL rule is INVISIBLE rather than
merely unreachable - it never appears in `tailscale status`, MagicDNS does not
resolve it, and the symptom is a downstream "no such host" that looks like a
DNS problem. That cost an hour today.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ansible/services/headscale/deploy_headscale_playbook.yml

@@ -79,15 +79,24 @@
         groups: headscale
         append: yes
 
-    - name: Create ACL policies file
+    # This used to write `{}` - an empty policy - over the real ACL, which was
+    # maintained by hand on the box. It had already flattened it once
+    # (/etc/headscale/acl.json.937464.2026-09-12@14:03:08~ is Ansible's own
+    # backup of the 1596-byte policy it replaced), and every subsequent
+    # site.yml run would have taken the whole tailnet's access rules with it.
+    #
+    # The policy now lives in templates/acl.json.j2, captured from the live
+    # file on 2026-09-19. validate first: a malformed policy is one headscale
+    # refuses to load, which is the same outage as an empty one.
+    - name: Deploy the Headscale ACL policy
       become: yes
-      copy:
+      ansible.builtin.template:
+        src: acl.json.j2
         dest: /etc/headscale/acl.json
-        content: |
-          {}
         owner: headscale
         group: headscale
         mode: '0640'
+        validate: "python3 -m json.tool %s"
       notify: Restart headscale
 
     - name: Deploy headscale configuration file