Include queried facts as host vars in -A inventory

`-A` emitted hosts with empty vars, so `-F ipaddress,enc_role -A` lost the facts
it just queried. Ansible inventories are far more useful with the values inline.

- Extract factsByHost() (the {host: {fact: value}} builder) and share it between
  -j and -A so the Ansible inventory attaches each host's queried fact(s) as
  host vars, keyed by real fact name.
- Strengthen the Ansible test to assert host vars and add a multi-fact case.

AGENTS.md

@@ -68,7 +68,7 @@ installed. To load ad-hoc in the current shell, e.g. zsh:
 ./node-lookup -R -1                       # node names only
 ./node-lookup -R -2                       # values only
 ./node-lookup -R -C                       # count occurrences
-./node-lookup -R -A                       # output as Ansible YAML inventory
+./node-lookup -R -A                       # output as Ansible YAML inventory (queried facts become host vars)
 ./node-lookup -j                          # output as JSON { host → { fact → value } }
 ./node-lookup --url http://host:8080/...  # override PuppetDB URL for this invocation
 echo -e "node1\nnode2" | ./node-lookup -R # pipe node names via stdin
@@ -116,7 +116,7 @@ Show the active configuration (after all overrides applied):
 - **Match value / `matchValue()`**: the value to match comes from `-m/--match` or, if that is empty, an optional positional argument. The positional fallback exists because pflag does not attach a space-separated value to a string flag grouped with a bool flag, so in `-pm k8s` the `k8s` arrives as a positional. `-m` still wins when both are given.
 - **`queryPuppetDB(url, query)`**: takes the URL as a parameter — never reads globals.
 - **`processResults()`**: iterates facts, returns sorted `"certname value"` strings. JSON string values are unquoted; other JSON types rendered as compact JSON.
-- **Output modes**: JSON (`-j`), count (`-C`), Ansible YAML (`-A`), node-only (`-1`), value-only (`-2`), default (node + value).
+- **Output modes**: JSON (`-j`), count (`-C`), Ansible YAML (`-A`), node-only (`-1`), value-only (`-2`), default (node + value). `-j` and `-A` share `factsByHost()`, so both attach the queried fact(s) per host — as an object under the host (`-j`) or as inventory host vars (`-A`).
 - **Stdin support**: `stdinReader()` reads node names from stdin only when it is a real pipe/redirect carrying data (and no `-n` given). Terminals, `/dev/null`, and empty/closed pipes fall through to a normal query — so running without a TTY (e.g. invoked by an agent or CI) behaves like an interactive run instead of consuming empty input.
 - **SIGPIPE handling**: `signal.Ignore(syscall.SIGPIPE)` so pipes to `head` etc. work cleanly.