sys-service: add ExecStartPost support and adjust health/repair roles

- extended generic systemctl template to support ExecStartPost
- health-docker-volumes: run main script with whitelist, trigger both compose alarm and cleanup on failure
- repair-docker-hard: added ExecStartPre lock, ExecStart, and ExecStartPost to trigger compose alarm always, plus cleanup on failure
- removed obsolete role-specific systemctl.service.j2 templates
- improved consistency across vars and defaults

See: https://chatgpt.com/share/68ad6cb8-c164-800f-96b6-a45c6c7779b3

roles/sys-service/templates/systemctl.service.j2

@@ -11,7 +11,8 @@ Type={{ system_service_tpl_type }}
   ('TimeoutStartSec', system_service_tpl_timeout_start_sec),
   ('ExecStartPre',    system_service_tpl_exec_start_pre),
   ('ExecStart',       system_service_tpl_exec_start),
-  ('RuntimeMaxSec',   system_service_tpl_runtime)
+  ('ExecStartPost',   system_service_tpl_exec_start_post),
+  ('RuntimeMaxSec',   system_service_tpl_runtime),
 ] %}
 {{ val | systemd_directive(key) }}
 {% endfor %}