Replace deprecated ansible_user_dir/ansible_user_id with
ansible_facts['user_dir'/'user_id'] across all roles. Switch git repo
URLs from HTTPS to SSH. Split site.yml into two plays so user-facing
roles (dotfiles, scripts, hotkeys) run without become.