feat: configurable branding, browser policies, gnome-initial-setup fix

Branding:
- Move avatar and background SVGs to files/branding/ subdirectory
- Add dfe_avatar_file and dfe_background_file variables in defaults
- Avatar and background paths now configurable via variables

Browser Policies:
- Add browser_policies.yml for Chrome and Brave enterprise policies
- Chrome: unrestricted testing browser (no SafeSites, allow incognito)
- Brave: privacy-focused daily driver (Tor disabled, Rewards disabled)

GNOME Initial Setup:
- Add /etc/skel/.config/gnome-initial-setup-done for system-wide suppression
- Ensure user .config directory exists before creating done file
- Multiple suppression methods to ensure wizard never appears

Security:
- Disable automatic reboot for unattended-upgrades (GNOME nag instead)

Docker:
- Add KVM group membership for nested virtualization support

Author: Derek

ansible/roles/dfe_developer/defaults/main.yml

@@ -28,3 +28,20 @@ dfe_docker_repo_url: "{{ dfe_docker_repo_base_url }}/{{ dfe_docker_distro_name }
 dfe_docker_desktop_url_ubuntu: "https://desktop.docker.com/linux/main/amd64/docker-desktop-amd64.deb"
 dfe_docker_desktop_url_fedora: "https://desktop.docker.com/linux/main/amd64/docker-desktop-x86_64.rpm"
 dfe_docker_arch: "amd64"
+
+# ============================================================================
+# BRANDING / CUSTOMIZATION
+# ============================================================================
+# Default branding assets are in files/branding/
+# To customize: replace files in branding/ or override these variables
+
+# User avatar for GDM login screen (converted to PNG at runtime)
+# Set to empty string to skip avatar deployment
+dfe_avatar_file: "branding/avatar.svg"
+
+# Desktop background wallpaper
+# Set to empty string to skip background deployment
+dfe_background_file: "branding/background.svg"
+
+# Install LibreOffice (opt-in, disabled by default)
+dfe_install_libreoffice: false

ansible/roles/dfe_developer/files/branding/avatar.svg

@@ -14,6 +14,10 @@ enabled-extensions=['monitor@astraext.github.io', 'dash-to-dock@micxgx.gmail.com
 # Ubuntu Dock conflicts with Dash to Dock
 disabled-extensions=['ubuntu-dock@ubuntu.com', 'workspace-indicator@gnome-shell-extensions.gcampax.github.com', 'apps-menu@gnome-shell-extensions.gcampax.github.com']
 
+# Pinned applications in taskbar/dock (order matters)
+# Files, Brave, Chrome, VS Code, Bitwarden
+favorite-apps=['org.gnome.Nautilus.desktop', 'brave-browser.desktop', 'google-chrome.desktop', 'code.desktop', 'com.bitwarden.desktop']
+
 [org/gnome/shell/extensions/astra-monitor]
 # Astra Monitor configuration
 processor-header-show=true

…s/dfe_developer/files/dfe-background.svg …_developer/files/branding/background.svgansible/roles/dfe_developer/files/dfe-background.svg renamed to ansible/roles/dfe_developer/files/branding/background.svg ansible/roles/dfe_developer/files/dfe-background.svg renamed to ansible/roles/dfe_developer/files/branding/background.svg

@@ -14,6 +14,10 @@ enabled-extensions=['monitor@astraext.github.io', 'dash-to-panel@jderose9.github
 # Ubuntu Dock conflicts with Dash to Panel
 disabled-extensions=['ubuntu-dock@ubuntu.com', 'workspace-indicator@gnome-shell-extensions.gcampax.github.com', 'apps-menu@gnome-shell-extensions.gcampax.github.com']
 
+# Pinned applications in taskbar/dock (order matters)
+# Files, Brave, Chrome, VS Code, Bitwarden
+favorite-apps=['org.gnome.Nautilus.desktop', 'brave-browser.desktop', 'google-chrome.desktop', 'code.desktop', 'com.bitwarden.desktop']
+
 [org/gnome/shell/extensions/astra-monitor]
 # Astra Monitor configuration
 processor-header-show=true