GRM-17: fix: make grm list retrieve runner status correctly

- run_ad_hoc() now raises AnsibleError on non-zero exit, surfacing
  stderr instead of silently returning empty stdout
- list_runners() passes become=True to run_ad_hoc since systemctl
  is-active requires root privileges
- Add i18n translations for ad-hoc failure messages
- Add unit test for run_ad_hoc failure case
- Update list_runners test to expect become=True
- 119 tests, 100% coverage, pyright clean, ruff clean

tests/unit/test_executor.py

@@ -206,3 +206,14 @@ class TestAnsibleExecutorAdHoc:
         assert result == "ok"
         cmd = mock_run.call_args.args[0]
         assert "--become" in cmd
+
+    def test_run_ad_hoc_failure_raises(self, tmp_path: Path) -> None:
+        executor = AnsibleExecutor(log_dir=tmp_path)
+        result_mock = MagicMock()
+        result_mock.stdout = ""
+        result_mock.returncode = 1
+        result_mock.stderr = "SSH timeout"
+
+        with patch("subprocess.run", return_value=result_mock):
+            with pytest.raises(AnsibleError, match="SSH timeout"):
+                executor.run_ad_hoc("10.0.0.1", "ubuntu", None, "shell", "cmd")

tests/unit/test_runner_manager.py

@@ -408,7 +408,7 @@ class TestRunnerManager:
         assert runners[0]["host"] == "10.0.0.1"
         assert runners[0]["status"] == "active"
         mock_executor.run_ad_hoc.assert_called_once_with(
-            "10.0.0.1", "ubuntu", "/key", "shell", "systemctl is-active gitea-runner@r1"
+            "10.0.0.1", "ubuntu", "/key", "shell", "systemctl is-active gitea-runner@r1", become=True
         )
 
     def test_list_runners_empty(self) -> None: