fix(roles): close preload-context coverage gaps for compose+inj-all

Two roles dropped their post-preload coverage because work that
needed to re-evaluate after the preload-context flag flipped was
trapped behind a once-gate from the first (preload) invocation:

sys-svc-compose/01_core.yml: the docker-mgmt include loop
(cln-docker, bkp-docker-2-loc, hlth-container, hlth-volumes,
rpr-container-hard) lived inside 01_core, which is itself gated by
`run_once_sys_svc_compose`. First call ran during preload, set the
once-flag, and the loop's `not _service_loader_preloading` gate
fired False; subsequent compose invocations skipped 01_core entirely
so the loop never re-fired. Move the loop into main.yml outside the
once-gate so the preload-gate is the only thing left in front of
it.

sys-front-inj-all/main.yml: the `sys-svc-webserver-core` include
sat inside an outer `block: when: run_once_sys_front_inj_all is not
defined`. Preload set that flag and every later invocation skipped
the block, so webserver-core was never re-entered outside preload
and its own hlth-include retry never saw `preload=false`. Drop the
outer block (the flag had no other consumers) and call webserver-
core unconditionally; idempotency for its heavy work is already
handled by `run_once_sys_svc_webserver_core` inside webserver-core
itself. The role legitimately has no role-level once semantics (CDN,
inj-*, body_filter.lua are per-application work) so mark it
`# nocheck: run-once` with the reason inline.

Transitive misses (cln-anon-volumes, rpr-container-soft,
cln-faild-bkps) resolve once their includers (cln-docker /
hlth-container / bkp-docker-2-loc) start running again.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

roles/sys-front-inj-all/tasks/main.yml

@@ -1,13 +1,10 @@
 ---
-- block:
-    - name: Include dependency 'sys-svc-webserver-core'
-      include_role:
-        name: sys-svc-webserver-core
-      vars:
-        compose_repository_pull: false # Deactivated here to don't inhire this
-      when: run_once_sys_svc_webserver_core is not defined
-    - include_tasks: utils/once/flag.yml
-  when: run_once_sys_front_inj_all is not defined
+# nocheck: run-once — per-application role: every invocation must (re)apply CDN dirs, inj-*, body_filter.lua for the current `application_id`.
+- name: Include dependency 'sys-svc-webserver-core'
+  include_role:
+    name: sys-svc-webserver-core
+  vars:
+    compose_repository_pull: false # Deactivated here to don't inhire this
 
 - name: "Setup CDN directories for '{{ domain }}'"
   include_role:

roles/sys-svc-compose/tasks/01_core.yml

@@ -31,16 +31,3 @@
     mode: "0755"
     owner: root
     group: root
-
-- name: Include backup, repair and health services for docker
-  include_role:
-    name: "{{ service_role }}"
-  loop:
-    - sys-ctl-cln-docker
-    - sys-ctl-bkp-docker-2-loc
-    - sys-ctl-hlth-container
-    - sys-ctl-hlth-volumes
-    - sys-ctl-rpr-container-hard
-  loop_control:
-    loop_var: service_role
-  when: not (_service_loader_preloading | default(false) | bool)

roles/sys-svc-compose/tasks/main.yml

@@ -2,6 +2,19 @@
 - include_tasks: 01_core.yml
   when: run_once_sys_svc_compose is not defined
 
+- name: Include backup, repair and health services for docker
+  include_role:
+    name: "{{ service_role }}"
+  loop:
+    - sys-ctl-cln-docker
+    - sys-ctl-bkp-docker-2-loc
+    - sys-ctl-hlth-container
+    - sys-ctl-hlth-volumes
+    - sys-ctl-rpr-container-hard
+  loop_control:
+    loop_var: service_role
+  when: not (_service_loader_preloading | default(false) | bool)
+
 # This could lead to problems in sys-svc-compose directories which are based on a git repository
 # @todo Verify that this isn't the case. E.g. in accounting
 - name: "Create all sys-svc-compose directories (including parent directories) for '{{ application_id }}'"