Split base hardening packages into required and optional

software-properties-common removed — dropped from Debian 13 (trixie).
unattended-upgrades and apt-listchanges moved to optional task with
ignore_errors so missing packages don't fail the entire deployment.

phantom/playbooks/common/base_hardening.yml

@@ -27,16 +27,22 @@
         name:
           - ufw
           - fail2ban
-          - unattended-upgrades
-          - apt-listchanges
           - curl
           - wget
           - gnupg
           - ca-certificates
-          - software-properties-common
         state: present
       when: ansible_os_family == "Debian"
 
+    - name: Install optional hardening packages
+      apt:
+        name:
+          - unattended-upgrades
+          - apt-listchanges
+        state: present
+      when: ansible_os_family == "Debian"
+      ignore_errors: true
+
     # ─── UFW Firewall ───────────────────────────────────────────────────
     - name: Set UFW default deny incoming
       ufw: