fix(harbor): the robot reconcile has to read under --check

[kholisrag]

Follow-up to #17, found by actually running it.

The bug

ansible.builtin.uri does not support check mode. Under --check both reads
skipped, the map task saw no data, and Assert every declared robot exists
failed against a Harbor that holds the robot perfectly well:

TASK [Assert every declared robot exists]
fatal: Harbor holds no system robot whose name ends in the declared one...

A dry run that reports a problem it invented is worse than no dry run — --check
is the one mode whose entire job is to be trusted before a write, and this is a
file whose entire job is to refuse a dangerous write.

Both reads are GETs carrying changed_when: false, so check_mode: false
changes nothing about them and leaves the PUT as the only simulated step.

Also

• Declares the first robot in vars/vault.yaml. Reading its live grants was
  worth doing: the ticket that prompted this said the robot held four, and it
  holds fourteen — immutable-tag:* and tag-retention:* on project:*,
  which it needs to write per-project policy. A declaration built from the
  ticket would have tried to revoke ten of them, and the widen-only guard would
  have stopped the run rather than doing it. That is the guard earning its keep
  on its first real use.
• Corrects the report line, which said "widened this run" while measuring
  the delta taken before the PUT — so a --check run claimed a change it
  had not made. It now says "with grants to add", which is true in both modes.

Verified against the live Harbor

--check   : 1 declared system robot(s); 1 with grants to add.   changed=0
real run  : Apply the declared grants ... changed                changed=1
re-run    : 1 declared system robot(s); 0 with grants to add.   changed=0

And downstream, in the repository this grant exists for: its playbook now gets
past the 403 that prompted all of this, 22 tasks passing where it used to stop
at 20.

Unrelated, but you should know

--tags robots cannot reach the robot tasks without --skip-tags always,
because preflight fails:

Harbor needs at least 4 GiB of RAM, this host has 3789 MiB.

That assertion compares ansible_facts['memtotal_mb'] against 3800, and
memtotal_mb is always a few hundred MiB below the RAM the VM was given — the
kernel and firmware reserve it. So a host sitting exactly on its 4 GiB balloon
floor reports ~3789 and fails a check meant to catch a VM with less than 4 GiB.
Not touched here: changing a safety assertion is its own decision, and this PR
should not carry it.