Feature request: rtk ansible-lint wrapper (group violations by rule, cap output)

Summary

Add rtk ansible-lint to the built-in wrapper set. ansible-lint is one of the verbose linters that doesn't yet have an rtk filter, and like rtk lint (ESLint) and rtk rubocop, it benefits from rule-grouping + ANSI strip.

Sizing

Real-world frequency from a 30-day Claude Code window on an Ansible-heavy infra repo: 11 invocations flagged by rtk discover as unhandled. Each invocation against a non-trivial role tree produces 100-500 lines of output (per-task violations, with full file paths + 5+ line context blocks per finding), often with ANSI color.

Two representative invocations:

ansible-lint roles/ playbooks/
ansible-lint --offline -p

I checked the issue tracker and didn't find a prior request for this specific tool — closest neighbors are #1607/#1680/#789 (ssh) and #1737/#1738 (op/1Password CLI), which suggests linter wrappers for less-mainstream-but-still-common tools fit the project's direction.

Proposed shape

Pattern lifted from rtk lint (ESLint grouped output) and rtk rubocop:

• Strip ANSI escapes
• Strip the WARNING: PATH altered to expand ~ and AnsibleWarning: Enable tracemalloc boilerplate that ansible-lint emits unconditionally
• Group violations by rule-id (yaml[indentation], var-naming, risky-shell-pipe, etc.) with a <rule-id>: <count> header line per group
• Show the first N (e.g. 3) sample paths per rule-id, then a … +K more line
• Preserve the final summary line (Passed: 0 failure(s), 0 warning(s) … / Failed: …) verbatim — that's the signal an agent acts on
• Pass-through mode for --version, --help, -L (list rules), -T (list tags) — these have small fixed output and shouldn't be touched

Subcommand surface should mirror existing wrappers: rtk ansible-lint <args...> shells through to ansible-lint <args...> with the filter applied to stdout/stderr.

Why this fits the existing pattern

• The rtk lint wrapper already does ESLint rule-grouping, so the heuristic exists in code.
• ansible-lint output is structurally similar to ESLint's: file path, line:col, rule-id, message, optional context block.
• ansible-lint exit code semantics are the same as ESLint (0 = clean, non-0 = violations), so no special handling needed for && / || chains.

Verification

If an agent runs rtk ansible-lint roles/some-role/ on a tree with 30 violations spanning 5 rule-ids, expected compressed output is ~10 lines (rule-id headers + 3 sample paths each + summary), down from ~150 lines raw. Estimated savings: ~70% on a typical infra-repo lint pass, similar to the rtk lint baseline.

Out of scope for this issue (tracked separately upstream)

• ssh wrapper — already requested in #1607, #1680, #789, #1708, #1709 (and #1654 tracking the rewrite-path bug for the existing ssh filter prototype). +1 from me on those rather than a duplicate here.
• rtk discover undercounting hook-rewritten commands — already tracked in #1643, #1441, #1055, #929, #789.

Environment

• rtk 0.39.0 (just upgraded from 0.35.0; verified the parser fixes for ps -p PID -o, pnpm install --frozen-lockfile, grep -q, and ansible-playbook --syntax-check all landed in 0.36-0.39, nice work)
• ansible-lint 26.4.0 / ansible-core 2.20.5
• macOS arm64, brew install