The user-module tasks in post-clone.yml were running without become, so
modifying /etc/passwd failed with 'usermod: Permission denied' when the
connection user (e.g. admin) was non-root. Add become: true to both
password tasks. Block-level become is avoided because the known_hosts
task in the same file is delegate_to: localhost and should not sudo on
the controller.
Also fix the variable name passed to the system_setup ssh tasks_from:
post-clone.yml was setting 'regenerate_ssh_keys', but ssh.yml gates on
'regenerate_ssh_host_keys'. The mismatch caused cloned containers to
silently keep the source template's SSH host keys.
Rename lxc_password to lxc_root_password for consistency with the new
lxc_user_password (replaces the previously bare 'password' variable in
post-clone.yml, which silently collided with any same-named caller var).
Add lxc_user_name (default: admin) so the non-root account managed in
post-clone.yml is no longer hardcoded. Apply default(omit) to the root
password in create.yml so it is genuinely optional as documented.
BREAKING CHANGE: callers passing lxc_password or a bare 'password' var
must rename to lxc_root_password and lxc_user_password respectively.
patrick