fix: PATH config, Chrome repo duplicates, apply:tags for all includes

PATH Configuration:
- Added /etc/profile.d/dfe-path.sh for ~/.cargo/bin, ~/.local/bin, ~/.npm-global/bin
- Ensures uv, claude, gext, semantic-release are in PATH for all users

Chrome Repository:
- Use copy module instead of apt_repository to overwrite entire file
- Prevents Chrome post-install script from creating duplicate entries

Ansible Tags:
- Added apply:tags to ALL include_tasks in dfe_developer main.yml
- Ensures child tasks run properly when using --tags

Updated STATE.md with Session 5 notes including:
- Telemetry disable documentation
- Known git-core PPA weak key warning (Launchpad issue, cannot fix)
- Verified tool versions on Ubuntu 24.04

Author: Derek

ansible/roles/dfe_developer/tasks/chrome.yml

@@ -35,11 +35,16 @@
         dest: /etc/apt/keyrings/google-chrome.asc
         mode: '0644'
 
-    - name: Add Google Chrome repository
-      ansible.builtin.apt_repository:
-        repo: "deb [arch=amd64 signed-by=/etc/apt/keyrings/google-chrome.asc] https://dl.google.com/linux/chrome/deb/ stable main"
-        filename: google-chrome
-        state: present
+    # Chrome's post-install script adds its own repo line without signed-by
+    # We need to ensure only our modern signed-by format is used
+    - name: Write clean Chrome repository file (avoid duplicates)
+      ansible.builtin.copy:
+        content: |
+          # Managed by DFE Developer Ansible - DO NOT EDIT
+          # Chrome's post-install script may add duplicates, this file is cleaned on each run
+          deb [arch=amd64 signed-by=/etc/apt/keyrings/google-chrome.asc] https://dl.google.com/linux/chrome/deb/ stable main
+        dest: /etc/apt/sources.list.d/google-chrome.list
+        mode: '0644'
 
     - name: Install Google Chrome
       ansible.builtin.apt:

ansible/roles/dfe_developer/tasks/main.yml

@@ -10,16 +10,22 @@
 - name: Configure OS repositories (mirrors, performance)
   ansible.builtin.include_tasks:
     file: repository.yml
+    apply:
+      tags: ['repository']
   tags: ['repository']
 
 - name: Configure security (automatic updates)
   ansible.builtin.include_tasks:
     file: security.yml
+    apply:
+      tags: ['security']
   tags: ['security']
 
 - name: Install Docker
   ansible.builtin.include_tasks:
     file: docker.yml
+    apply:
+      tags: ['docker']
   tags: ['docker']
 
 - name: Install development utilities
@@ -32,6 +38,8 @@
 - name: Install Python development tools
   ansible.builtin.include_tasks:
     file: uv.yml
+    apply:
+      tags: ['python']
   tags: ['python']
 
 - name: Install Git and version control tools
@@ -44,27 +52,37 @@
 - name: Install cloud tools
   ansible.builtin.include_tasks:
     file: cloud.yml
+    apply:
+      tags: ['cloud']
   tags: ['cloud']
 
 - name: Install Kubernetes tools
   ansible.builtin.include_tasks:
     file: k8s.yml
+    apply:
+      tags: ['k8s']
   tags: ['k8s']
 
 - name: Install data platform tools
   ansible.builtin.include_tasks:
     file: data_tools.yml
+    apply:
+      tags: ['data']
   tags: ['data']
 
 - name: Install VS Code
   ansible.builtin.include_tasks:
     file: vscode.yml
+    apply:
+      tags: ['vscode']
   tags: ['vscode']
   when: dfe_has_gnome | default(false)
 
 - name: Install Google Chrome
   ansible.builtin.include_tasks:
     file: chrome.yml
+    apply:
+      tags: ['chrome']
   tags: ['chrome']
   when: dfe_has_gnome | default(false)
 
@@ -169,9 +187,13 @@
 - name: Configure shell (bash history auto-commit)
   ansible.builtin.include_tasks:
     file: shell_config.yml
+    apply:
+      tags: ['shell']
   tags: ['shell']
 
 - name: Verify base tools installation
   ansible.builtin.include_tasks:
     file: verify.yml
+    apply:
+      tags: ['verify']
   tags: ['verify']

ansible/roles/dfe_developer/tasks/shell_config.yml

@@ -1,5 +1,34 @@
 ---
-# Shell configuration (bash history auto-commit, etc.)
+# Shell configuration (PATH, bash history auto-commit, etc.)
+
+# ============================================================================
+# PATH CONFIGURATION (SYSTEM-WIDE)
+# Add common tool directories to PATH for all users
+# ============================================================================
+
+- name: Configure DFE PATH additions system-wide (Linux)
+  ansible.builtin.copy:
+    dest: /etc/profile.d/dfe-path.sh
+    content: |
+      # DFE Developer Environment PATH additions
+      # System-wide configuration for all users
+
+      # Add ~/.cargo/bin for UV, Rust tools
+      if [ -d "$HOME/.cargo/bin" ]; then
+          export PATH="$HOME/.cargo/bin:$PATH"
+      fi
+
+      # Add ~/.local/bin for user-installed tools (pipx, gext, etc.)
+      if [ -d "$HOME/.local/bin" ]; then
+          export PATH="$HOME/.local/bin:$PATH"
+      fi
+
+      # Add ~/.npm-global/bin for npm global tools (claude, semantic-release, etc.)
+      if [ -d "$HOME/.npm-global/bin" ]; then
+          export PATH="$HOME/.npm-global/bin:$PATH"
+      fi
+    mode: '0644'
+  when: ansible_distribution in ['Fedora', 'Ubuntu']
 
 # ============================================================================
 # BASH HISTORY AUTO-COMMIT (SYSTEM-WIDE)