fix(guide_role): resolve the variable fallback the same way

The lookup takes the role from its term and falls back to reading
application_id out of the play's variables. That read was raw, which is the
trap that took down three jobs from webserver_resource, so it now goes through
resolve_var like every other lookup.

Prevention rather than a fix. The fallback is the else of a term that the only
caller always passes, and where it would fire web-app-docs sets application_id
literally; the roles carrying a templated id reach it through sys-stk-full,
which web-app-docs does not. The consequence would also have differed: an
unrendered string never matches a peer, so the replay would have asked the
site for a role named after the template and failed on the page rather than in
the lookup.

Measured: with the resolver's body stripped back to the raw read this test and
the webserver_resource one both fail, and both pass with it restored.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/python/plugins/lookup/test_guide_role.py

@@ -9,6 +9,14 @@ INVOKABLE = ["web-app-docs", "web-app-nextcloud", "svc-db-postgres", "dsk-gnt-cl
 NO_PIN = {ENV_VAR: ""}
 
 
+class _Templar:
+    def __init__(self, resolved):
+        self._resolved = resolved
+
+    def template(self, value):
+        return self._resolved.get(value, value)
+
+
 class TestGuideRole(unittest.TestCase):
     def test_the_only_invokable_peer_wins(self):
         self.assertEqual(
@@ -116,6 +124,23 @@ class TestGuideRoleLookup(unittest.TestCase):
         )
         self.assertEqual(result, ["web-app-docs"])
 
+    @patch.dict(os.environ, NO_PIN)
+    @patch("plugins.lookup.guide_role.list_invokable_app_ids")
+    def test_a_variable_that_is_still_a_template_is_resolved(self, invokable):
+        """The play holds application_id raw, so a role that sets it from
+        another variable would otherwise be compared as '{{ ... }}'."""
+        invokable.return_value = INVOKABLE
+        lookup = LookupModule()
+        lookup._templar = _Templar({"{{ stack_app }}": "web-app-docs"})
+        result = lookup.run(
+            [],
+            variables={
+                "application_id": "{{ stack_app }}",
+                "group_names": ["web-app-docs", "web-app-nextcloud"],
+            },
+        )
+        self.assertEqual(result, ["web-app-nextcloud"])
+
     @patch.dict(os.environ, {ENV_VAR: "  dsk-gnt-claude  "})
     @patch("plugins.lookup.guide_role.list_invokable_app_ids")
     def test_the_environment_pins_the_role(self, invokable):