Reduce molecule test boilerplate with shared task files

[Oddly]

The molecule test suite has ~600-700 lines of duplicated verify/converge code across 29 scenarios. The `shared/` directory pattern already exists (`set_ci_watermarks.yml`, `cleanup_cache.yml`, `prepare_common.yml`) — extending it to cover the remaining repeated blocks would cut maintenance surface significantly.

Verify patterns to extract:

Pattern	Scenarios	Lines saved
Fetch elastic password (grep initial_passwords, register elastic_pass)	16	~112
ES cluster health URI + assert (single-node variant with run_once)	4	~42
ES cluster health URI + assert (multi-node with retries and group guard)	7	~108
Set elasticsearch_ca fact	8	~18
Kibana availability check (URI + assert overall.level == available)	5	~56
Logstash port-5044 wait + diagnostics block	4	~90
Logstash version detect + config syntax check	4	~54
Logstash service running check	4	~15

Proposed shared verify files:

• `shared/verify_fetch_password.yml` — parameterize delegate_to, run_once
• `shared/verify_es_health.yml` — parameterize single vs multi-node, wait_for_status
• `shared/verify_kibana_available.yml` — parameterize retries, URL scheme
• `shared/verify_logstash_port.yml` — combine port wait, diagnostics, version detect, and syntax check

Converge patterns to extract:

Pattern	Scenarios	Lines saved
Cert generation (raw openssl — CA + transport + HTTP)	4	~300
Cert generation (community.crypto)	2	~60
ES + watermarks + cache cleanup sequence	6	~60
Upgrade version detection (apt-cache/dnf)	2	~20

Proposed shared converge files:

• `shared/generate_test_certs_openssl.yml` — parameterize which cert types to generate
• `shared/generate_test_certs_crypto.yml` — for logstash_ssl and logstash_standalone_certs
• `shared/converge_elasticsearch.yml` — deploy ES + set watermarks + clean cache

molecule.yml boilerplate (~522 lines) — every scenario copies the same 19-line provisioner block verbatim. Standard Molecule doesn't support file inheritance, but this could be addressed by scripting generation or documenting the canonical block once and referencing it.

prepare.yml simplification — 19 of 23 prepare.yml files are either just `include_tasks: ../shared/prepare_common.yml` or that plus an identical /etc/hosts population task. Moving the /etc/hosts task into `prepare_common.yml` (conditioned on `groups['all'] | length > 1`) would make 17 of them identical single-include files.