feat(sys_autoupdate): notify on pending kernel reboot

Detect drift between the running kernel and the newest installed one
(Arch: /usr/lib/modules vs uname -r; Debian: /var/run/reboot-required)
and push a weekly ntfy reminder until the host is rebooted.

Also bundles the in-flight ignore-packages feature and hostname
refactor in the autoupdate script.

roles/sys_autoupdate/README.md

@@ -27,6 +27,26 @@ sys_autoupdate_ntfy_topic: your-notification-topic
 
 OS-specific commands are defined in `vars/archlinux.yml` and `vars/debian.yml`, loaded automatically via `ansible_facts['os_family']`.
 
+## Excluding packages from auto-update
+
+Set `sys_autoupdate_ignore_packages` to a list of package names to hold back. Useful when running out-of-tree kernel modules (ZFS DKMS, Nvidia, VirtualBox) that must stay in lockstep with the kernel.
+
+```yaml
+# Arch with ZFS DKMS
+sys_autoupdate_ignore_packages:
+  - linux
+  - linux-headers
+  - zfs-dkms
+  - zfs-utils
+```
+
+Translation per OS:
+
+- **Arch:** passed as `pacman --ignore=pkg1,pkg2` on each run. Held packages are also filtered out of the pending-update detection.
+- **Debian/Ubuntu:** reconciled via `apt-mark hold` at role-apply time. Holds added by this role are not automatically released when removed from the list — run `sudo apt-mark unhold <package>` to release them manually.
+
+**Warning:** when holding the kernel, also hold matching headers and any DKMS modules together. Holding the kernel while letting `zfs-dkms` advance can break the DKMS build on next boot.
+
 ## Podman image updates
 
 When `sys_autoupdate_podman_enabled: true` (default), the script scans `podman_projects_dir` for `docker-compose.yml` files, pulls images via `podman-compose pull`, and recreates containers with `podman-compose up -d` for projects with updated images. Dangling images are pruned after each run.
@@ -41,3 +61,4 @@ The script runs as root (for package management) and uses `sudo -u {{ ansible_us
 | `x` | Update or pod restart failed |
 | `warning` | Distro news requires manual review (Arch) |
 | `whale` | Podman images updated |
+| `arrows_counterclockwise` | Running kernel older than installed — reboot pending (notified weekly, `sys_autoupdate_reboot_notify_weekday`) |