Every ansible-playbook run from a coding agent failed before reading the playbook, even --syntax-check. The agent shell hands Ansible non-blocking file handles; `&1 | cat` gives it blocking ones.
A Debian 13 server had unattended-upgrades enabled, its timers ran every day, and 61 security updates sat uninstalled. The config used Ubuntu's Allowed-Origins lines, which match the suite, and Debian's security suite is stable-security, not trixie-security.