fix: keep install_recommends, remove unwanted packages explicitly

Changed Ubuntu desktop install strategy:
- Keep install_recommends: true (default) to get essential packages:
  - gnome-keyring, gnome-remote-desktop, gnome-terminal
  - gnome-disk-utility, gnome-system-monitor, gnome-calculator
  - evince, eog, seahorse, xdg-desktop-portal-gnome
  - yaru-theme-*, fonts-ubuntu, fonts-noto-*, bluez, cups

- Explicitly remove unwanted packages after install:
  - firefox (we install Chrome + Brave)
  - gnome-initial-setup (we suppress anyway)
  - snapd (we prefer apt/flatpak, hold to prevent reinstall)
  - ubuntu-report, whoopsie, apport-gtk, apport (telemetry)

This gives us a complete desktop with all essential tools while
removing only the specific packages we don't want.

Author: Derek

ansible/roles/dfe_developer/tasks/desktop.yml

@@ -30,15 +30,41 @@
 # UBUNTU
 # ============================================================================
 
-# NOTE: install_recommends: false prevents LibreOffice from being pulled in
-# LibreOffice is opt-in via dfe_install_libreoffice variable
+# Install with recommends (gets all essential GNOME tools, fonts, themes)
+# Then remove unwanted packages explicitly
 - name: Install GNOME desktop (Ubuntu)
   ansible.builtin.apt:
     name: ubuntu-desktop-minimal
     state: present
-    install_recommends: false
   when: ansible_facts['distribution'] == 'Ubuntu'
 
+# Remove unwanted packages that come as recommends
+# - firefox: We install Chrome + Brave
+# - gnome-initial-setup: We suppress this anyway
+# - snapd: We don't use snaps, prefer apt/flatpak
+# - ubuntu-report, whoopsie, apport-gtk: Telemetry/crash reporting
+- name: Remove unwanted packages (Ubuntu)
+  ansible.builtin.apt:
+    name:
+      - firefox
+      - gnome-initial-setup
+      - snapd
+      - ubuntu-report
+      - whoopsie
+      - apport-gtk
+      - apport
+    state: absent
+    purge: true
+  when: ansible_facts['distribution'] == 'Ubuntu'
+
+# Prevent snapd from being reinstalled as a dependency
+- name: Hold snapd package to prevent reinstall
+  ansible.builtin.dpkg_selections:
+    name: snapd
+    selection: hold
+  when: ansible_facts['distribution'] == 'Ubuntu'
+  failed_when: false
+
 - name: Install LibreOffice (Ubuntu)
   ansible.builtin.apt:
     name: libreoffice