feat(roles): mark webserver+CSP infra as required_by web for deploy verifier

Adds `required_by: { categories: [web] }` to the four roles that MUST run
on every web-app/web-svc deploy: sys-svc-webserver-{core,https} (the
nginx/openresty stack) and sys-ctl-hlth-{webserver,csp} (the deploy-time
coverage checks).

Activates the cli.meta.roles.services.called verifier (added in the
previous commit). Without this annotation the verifier finds no required
roles and silently passes; with it, every web-* deploy round/pass asserts
that these four roles actually executed in the Ansible log, catching
silent coverage regressions like the one fixed in
158681821 (sys-svc-webserver-core: hlth-include moved out of once-flag).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

roles/sys-ctl-hlth-csp/meta/services.yml

@@ -1,6 +1,8 @@
 ---
 csp:
   lifecycle: beta
+  required_by:
+    categories: [web]
 csp-checker:
   image: ghcr.io/kevinveenbirkenbach/csp-checker
   version: 2.1.1

roles/sys-ctl-hlth-webserver/meta/services.yml

@@ -1,3 +1,5 @@
 ---
 webserver:
   lifecycle: beta
+  required_by:
+    categories: [web]

roles/sys-svc-webserver-core/meta/services.yml

@@ -1,3 +1,5 @@
 ---
 svc-webserver-core:
   lifecycle: beta
+  required_by:
+    categories: [web]

roles/sys-svc-webserver-https/meta/services.yml

@@ -1,3 +1,5 @@
 ---
 svc-webserver-https:
   lifecycle: beta
+  required_by:
+    categories: [web]