add empty role::workstation
separate pe things
declare r10k and hiera profiles in workstation role
slim firewall out of profile::base
remove r10k prerun command