- Move positions.yaml from /tmp (wiped on reboot) to /var/lib/promtail so
  promtail resumes where it left off after a reboot instead of either
  re-ingesting (duplicate lines in Loki) or skipping a chunk when a log
  was rotated during downtime.
- Create /var/lib/promtail with promtail:nogroup ownership (the
  apt-installed promtail user's primary group is nogroup).
- systemctl enable promtail so the service auto-starts on boot; previously
  only restart was called, so promtail did not survive a VM reboot.
- set -euo pipefail + DEBIAN_FRONTEND=noninteractive so the script aborts
  on first failure and runs cleanly under automation, without debconf
  prompts on minimal hosts.
- Fix shebang typo (#/bin/bash -> #!/bin/bash).