fix(roles/monitoring_plugins)!: align the source install with the packages

[markuslf]

Pulls the source install of monitoring_plugins back in line with what the packages produce. Reference for the layout is build/install-plugins.sh in the monitoring-plugins repo (what rpm and deb run), and tools/install-monitoring-plugins for the permission and venv handling.

The package path and Windows are untouched.

What was broken

Defect	Since	Impact
venv missing httpx, pymysql, pypsrp, PySmbClient, pywinrm	2026-07-01 (venv rewrite)	every check that speaks HTTP, MySQL, SMB or WinRM returns UNKNOWN
notification plugins in notifications/, event plugins nowhere	2025-02-14	the shipped Director basket points at the flat path, so notifications never ran
/etc/bash_completion.d not created	2026-08-13	run aborts on a host without the bash-completion package
python3-packaging missing	always	run aborts on a minimal installation (RHEL 8 is fine, it has pkg_resources)
modes taken from the controller checkout	always	a controller umask of 027 or 077 leaves the plugins unusable for the monitoring user
four tasks changed on every run	2026-07-01	not idempotent

The dependency defect is a regression: before the venv rewrite the role installed lockfiles/pyXX/requirements.txt, which carries the resolved closure of linuxfabrik-lib including httpx. The rewrite replaced it with requirements.in minus linuxfabrik-lib and dropped the transitive dependencies with it. It became visible when lib.url moved to httpx on 2026-05-10.

Why the test did not catch it

monitoring_plugins_source/verify.yml runs cpu-usage, which only needs psutil, and asserts on Traceback / ModuleNotFoundError. Neither ever appears: lib/url.py imports httpx lazily inside fetch() and answers a missing module with a plain sentence. This PR adds nginx-status, which reaches lib.url.fetch() with no arguments, without nginx and without the host needing internet access (its default URL is on localhost, so a refused connection is the expected result). The assertion goes by the message, since both outcomes are UNKNOWN and the exit code cannot tell them apart.

Verified

install_method: 'source', version: 'dev' against systemd containers of Rocky 8, Rocky 9, Rocky 10, Debian 13 and Ubuntu 24.04:

• 292 plugins deployed, changed=0 on the second run,
• uptime and githubstatus run as the monitoring user (icinga / nagios),
• the new assertion fails on a venv with httpx removed and passes after a re-run of the role.

Molecule itself was not run (needs the libvirt VMs).

Two decisions worth a second opinion

1. Breaking Changes or Fixed for the notification plugin path. I put it under Breaking Changes because the deployed path changes and the old directory is removed, which is migration wording. It never matched our own Director basket, so nothing built on our config can have depended on it.
2. requirements.in or the lockfiles. I kept the "newest unpinned" policy the role README promises and install the library's requirements.in on top. The one-liner installer instead uses the hash-pinned lockfiles of both repos and then removes linuxfabrik-lib from the venv. Switching to the lockfiles would close this class of drift for good, since nothing would have to be filtered or reassembled, but it changes the documented policy.

Not in this PR

• install-monitoring-plugins.ps1 verifies the Authenticode signature of the MSI before installing, windows-package.yml does not. Worth pulling through, but I have no Windows host to verify it on.
• tools/install-monitoring-plugins itself does not deploy the event plugins, while the packages do. Currently one plugin (cloudflare-security-level). Upstream issue, not this repo.