refactor(dev-nix): factor Nix install steps into include_tasks to satisfy when-block lints

Two pre-existing lint failures on main (introduced in 45eea2892) blocked
`make test` from going green:

- test_excessive_repeated_when_in_tasks_files flagged the four
  `when: dev_nix_binary_path_before | length == 0` repeats across
  Purge / getent group / getent passwd / Run-installer tasks.
- test_blocks_with_when_and_sections_have_max_three_tasks rejects any
  `block:` carrying a block-level `when:` and more than 3 tasks per
  section, because the block-level `when:` does NOT skip parse-time
  resolution of inner tasks.

Final shape: the six install tasks live in
`02a_nix_install_only.yml` and are pulled in via a single
`include_tasks` guarded by the original `when:`. When the binary is
already present, Ansible never opens the included file at all.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

roles/dev-nix/tasks/02_non_arch_installer.yml

@@ -52,73 +52,8 @@
         ) | default("", true)
       }}
 
-- name: Purge stale nixbld users blocking the multi-user installer
-  ansible.builtin.script:
-    cmd: "{{ role_path }}/files/purge_stale_nixbld.sh"
-  register: dev_nix_purge_stale_nixbld_result
-  changed_when: >
-    dev_nix_purge_stale_nixbld_result.stdout is search('\\[CHANGED\\]')
-  failed_when: >
-    dev_nix_purge_stale_nixbld_result.rc != 0 or
-    dev_nix_purge_stale_nixbld_result.stdout is search('\\[FAIL\\]')
-  become: true
-  when: dev_nix_binary_path_before | length == 0
-
-- name: Read existing nixbld group entry before installer run
-  ansible.builtin.getent:
-    database: group
-    key: nixbld
-    fail_key: false
-  become: true
-  when: dev_nix_binary_path_before | length == 0
-
-- name: Set build group override for Nix installer when nixbld exists
-  ansible.builtin.set_fact:
-    dev_nix_installer_build_group_id: "{{ ansible_facts.getent_group.nixbld[1] }}"
-  when:
-    - dev_nix_binary_path_before | length == 0
-    - ansible_facts.getent_group is defined
-    - "'nixbld' in ansible_facts.getent_group"
-
-- name: Read existing nixbld1 user entry before installer run
-  ansible.builtin.getent:
-    database: passwd
-    key: nixbld1
-    fail_key: false
-  become: true
-  when: dev_nix_binary_path_before | length == 0
-
-- name: Set first build uid override for Nix installer when nixbld1 exists
-  ansible.builtin.set_fact:
-    dev_nix_installer_first_build_uid: "{{ ansible_facts.getent_passwd.nixbld1[1] }}"
-  when:
-    - dev_nix_binary_path_before | length == 0
-    - ansible_facts.getent_passwd is defined
-    - "'nixbld1' in ansible_facts.getent_passwd"
-
-- name: Run Nix installer in daemon (multi-user) mode if Nix is not installed
-  ansible.builtin.shell: >
-    "{{ dev_nix_installer_dest }}" --daemon
-  environment: >-
-    {{
-      (
-        (dev_nix_installer_build_group_id is defined)
-        | ternary(
-            {'NIX_BUILD_GROUP_ID': (dev_nix_installer_build_group_id | string)},
-            {}
-          )
-      )
-      | combine(
-          (
-            (dev_nix_installer_first_build_uid is defined)
-            | ternary(
-                {'NIX_FIRST_BUILD_UID': (dev_nix_installer_first_build_uid | string)},
-                {}
-              )
-          )
-        )
-    }}
-  become: true
+- name: Install Nix when no existing binary was detected
+  ansible.builtin.include_tasks: 02a_nix_install_only.yml
   when: dev_nix_binary_path_before | length == 0
 
 - name: Probe common nix binary paths after installation

roles/dev-nix/tasks/02a_nix_install_only.yml

@@ -0,0 +1,64 @@
+---
+# Bound by 02_non_arch_installer.yml's outer block guard
+# (`dev_nix_binary_path_before | length == 0`). Splitting these six tasks into
+# a separate include_tasks file keeps the test_block_size MAX_TASKS=3 threshold
+# from triggering on the parent block while preserving the single `when:` guard.
+
+- name: Purge stale nixbld users blocking the multi-user installer
+  ansible.builtin.script:
+    cmd: "{{ role_path }}/files/purge_stale_nixbld.sh"
+  register: dev_nix_purge_stale_nixbld_result
+  changed_when: >
+    dev_nix_purge_stale_nixbld_result.stdout is search('\\[CHANGED\\]')
+  failed_when: >
+    dev_nix_purge_stale_nixbld_result.rc != 0 or
+    dev_nix_purge_stale_nixbld_result.stdout is search('\\[FAIL\\]')
+
+- name: Read existing nixbld group entry before installer run
+  ansible.builtin.getent:
+    database: group
+    key: nixbld
+    fail_key: false
+
+- name: Set build group override for Nix installer when nixbld exists
+  ansible.builtin.set_fact:
+    dev_nix_installer_build_group_id: "{{ ansible_facts.getent_group.nixbld[1] }}"
+  when:
+    - ansible_facts.getent_group is defined
+    - "'nixbld' in ansible_facts.getent_group"
+
+- name: Read existing nixbld1 user entry before installer run
+  ansible.builtin.getent:
+    database: passwd
+    key: nixbld1
+    fail_key: false
+
+- name: Set first build uid override for Nix installer when nixbld1 exists
+  ansible.builtin.set_fact:
+    dev_nix_installer_first_build_uid: "{{ ansible_facts.getent_passwd.nixbld1[1] }}"
+  when:
+    - ansible_facts.getent_passwd is defined
+    - "'nixbld1' in ansible_facts.getent_passwd"
+
+- name: Run Nix installer in daemon (multi-user) mode if Nix is not installed
+  ansible.builtin.shell: >
+    "{{ dev_nix_installer_dest }}" --daemon
+  environment: >-
+    {{
+      (
+        (dev_nix_installer_build_group_id is defined)
+        | ternary(
+            {'NIX_BUILD_GROUP_ID': (dev_nix_installer_build_group_id | string)},
+            {}
+          )
+      )
+      | combine(
+          (
+            (dev_nix_installer_first_build_uid is defined)
+            | ternary(
+                {'NIX_FIRST_BUILD_UID': (dev_nix_installer_first_build_uid | string)},
+                {}
+              )
+          )
+        )
+    }}