fix(web-app-gitlab): wait for the webservice before converging the appearance

The appearance task starts a rails runner while the container is still booting, so a second Rails process races the first into Gitlab::Shell#generate_and_link_secret_token and dies on symlink: File exists @ /home/git/gitlab-shell/.gitlab_shell_secret. That is the whole failure of job 116229890606 in run 38673950436.

It is not leftover state: meta/volumes.yml carries no mount for /home/git, so the file lives in the webservice container's own writable layer and cannot survive a run. The health precondition the task relied on was lost when utils/mcp.yml's handler flush moved ahead of it; this restores it through the role's own 02_wait/wait_one.yml, the same helper 02_wait.yml already includes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-gitlab/tasks/03_design.yml

@@ -24,6 +24,11 @@
       register: gitlab_design_files
       when: design_branding.logo is string
 
+- name: "🔎 Wait until the GitLab webservice is healthy"
+  ansible.builtin.include_tasks: 02_wait/wait_one.yml
+  vars:
+    wait_container: "{{ GITLAB_WEBSERVICE_SERVICE_NAME }}"
+
 - name: "🔍 Resolve the GitLab webservice for the appearance"
   ansible.builtin.include_tasks: "{{ lookup('path_absolute', 'roles/sys-svc-compose/tasks/utils/swarm/resolve_host_cid.yml') }}"
   vars: