Refactor CDN and run_once handling

- Move run_once include from main.yml to 01_core.yml in desk-gnome-caffeine and desk-ssh
- Introduce sys-svc-cdn/01_core.yml to handle shared/vendor dirs once and role dirs per run
- Replace cdn.* with cdn_paths_all.* across inj roles
- Split cdn_dirs into cdn_dirs_role and CDN_DIRS_GLOBAL
- Ensure cdn_urls uses cdn_paths_all

Details: https://chatgpt.com/share/68b58d64-1e28-800f-8907-36926a9e9a9b

roles/desk-ssh/tasks/01_core.yml

@@ -48,4 +48,6 @@
     state: present
     create: yes
     mode: "0644"
-  become: false
+  become: false
+
+- include_tasks: utils/run_once.yml

roles/desk-ssh/tasks/main.yml

@@ -1,4 +1,3 @@
 - block:
   - include_tasks: 01_core.yml
-  - include_tasks: utils/run_once.yml
   when: run_once_desk_ssh is not defined