[dzschille]

Summary

When a deployment fails before activation, the rescue block in tasks/main.yml removes the failed release folder. This makes post-mortem debugging hard, since the partially deployed code (and any logs/artifacts inside the release) is gone.

This PR adds an opt-in variable ansistrano_keep_failed_release (default false, so existing behaviour is unchanged). When set to true, the failed release folder is kept for debugging.

Changes

• tasks/main.yml: skip the "Remove failed release" rescue task when ansistrano_keep_failed_release is truthy (uses | default(false) | bool, consistent with ansistrano_git_identity_key_shred)
• defaults/main.yml, docs/role-variables.md: declare and document the new variable
• test/rsync-test.yml: rework the failed-release tests and cover both branches

Test rework details

The existing failed-release tests (from ansistrano#410) were vacuous for two reasons:

1. Play-level ignore_errors: yes bypasses the role's block/rescue: the failing hook task is ignored and the deployment simply continues, so the rescue path (and the cleanup it performs) was never exercised (rescued=0 in the recap).
2. The preceding release-cleanup test leaks ansistrano_release_version into subsequent plays via set_fact, so the play-level version vars never took effect.

The tests now use block + include_role + rescue and real assert tasks, with a deterministic release version set via pre_tasks: set_fact:

• failed deployment without the flag → release is removed (assert)
• failed deployment with ansistrano_keep_failed_release: true → release is kept (assert)

Verification

• Full integration suite (./scripts/test-in-docker.sh integration): green, failed=0, rescued=4 (exactly the two new rescue pairs)
• Regression check: removing the feature line from tasks/main.yml makes the new suite fail exactly at the "kept" assertion; with the flag set to false (including as a string via -e) the release is correctly removed
• --syntax-check on test/main.yml: green