Closes#28
Adds mask-avahi.yml targeting the vms:physical inventory groups (all
Ubuntu QEMU VMs + ubuntu-manticore). Also adds avahi masking to the
cloud-init template so future VMs are hardened from first boot.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>