variant gate

The when: hw == "<target>" condition on hardware-specific Ansible tasks. Lets the shared role ship a baseline that is the same everywhere and a per-target task file that diverges only where it must. See Build → Image bake internals.