fix(base): confine /etc/hosts unsafe-write fallback to the Docker Molecule env

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

roles/base/tasks/mesh.yml

@@ -71,7 +71,9 @@
     regexp: '\s{{ _coordinator_fqdn | regex_escape }}$'
     line: "{{ base__mesh_coordinator_pin }} {{ _coordinator_fqdn }}"
     state: present
-    unsafe_writes: true   # /etc/hosts is a bind mount in Docker; atomic rename is impossible
+    # /etc/hosts is bind-mounted in the Docker Molecule container (atomic rename → EBUSY);
+    # this is a fallback only — production VMs still write atomically.
+    unsafe_writes: true
   vars:
     _coordinator_fqdn: "{{ base__mesh_management_url | regex_replace('^https?://', '') | regex_replace('[:/].*', '') }}"
   when: