One approach could be to read the syslog. Ansible produces lines like:

 Jun  4 17:03:00 MyHost ansible-git: …
 Jun  4 17:03:04 MyHost ansible-file: …
 Jun  4 17:03:06 MyHost ansible-apt: …

Not sure how platform dependent that is, thought…

Ansible Galaxy is great and easy for role discovery and role imports in general. Currently only the https://github.com/tommarshall/ansible-role-lynis role is available there.

Include a clean-up task to remove the installed Lynis dir after running an audit.

Lynis returns an error code when warnings occur. Under normal circumstances this prevents a playbook from continuing, say across servers. Ideally there would be an easy way (other than ignore warnings flag) to prevent the error code.

Ease fetching the resulting logs and report data, as the terminal output will only go so far.

What good is a role when it doesn't include a task to run the script? As simple as it might be, having a simple boolean in the defaults for triggering the task would be easy.