tools: rewrite ppf-deploy as playbook wrapper

Replace sequential ansible ad-hoc calls with ansible-playbook.
Add ansible_playbook_cmd to shared library. Supports --check
for dry runs.

tools/lib/ppf-common.sh

@@ -108,6 +108,17 @@ ansible_cmd() {
     )
 }
 
+# Runs ansible-playbook with venv activated and ANSIBLE_REMOTE_TMP set.
+# Usage: ansible_playbook_cmd <ansible-playbook args...>
+ansible_playbook_cmd() {
+    (
+        # shellcheck disable=SC1090
+        . "$ANSIBLE_VENV"
+        cd "$ANSIBLE_DIR"
+        ANSIBLE_REMOTE_TMP=/tmp/.ansible ansible-playbook "$@"
+    )
+}
+
 # ---------------------------------------------------------------------------
 # Remote podman/compose wrappers
 # ---------------------------------------------------------------------------