Refactor systemctl service handling with @ support

- Unified variable naming: system_service_id → systemctl_id
- Added automatic removal of trailing '@' for role directory resolution
- Improved first_found search: prefer target role, fallback to sys-systemctl defaults
- Split template resolution logic to avoid undefined variable errors
- Added assertion in sys-timer to forbid '@' in systemctl_id
- Corrected default systemctl.service.j2 template description
- Cleaned up path handling and script directory generation

Context: conversation about fixing template resolution and @ handling
https://chatgpt.com/share/68a39994-1bb0-800f-a219-109e643c3efb

roles/sys-systemctl/tasks/03_base.yml

@@ -1,18 +1,20 @@
+# roles/sys-systemctl/tasks/03_base.yml
 - name: "find best matching source for service script"
   set_fact:
     service_src: >-
-      {{
-        lookup('first_found', {
+      {{ lookup('first_found',
+        {
           'files': [
-            'templates/script.sh.j2', 
+            'templates/script.sh.j2',
             'templates/script.py.j2',
-            'files/script.sh',     
+            'files/script.sh',
             'files/script.py'
-          ]
-        }, errors='strict')
-      }}
-  when:
-    - systemctl_copy_files | bool
+          ],
+          'paths': [ systemctl_role_dir ]
+        },
+        errors='strict'
+      ) }}
+  when: systemctl_copy_files | bool
 
 - name: "Load file logic for '{{ systemctl_id }}'"
   include_tasks: 04_files.yml