fix(deploy): keep role setup in run_after order across hosts

A per-host `when` on the looped include_tasks made ansible insert the included blocks in host order instead of loop order: whichever host reached an item first decided when that item ran. With the nfs-server host last in the inventory, svc-storage-nfs-client mounted the export before svc-storage-nfs-server had deployed it, and the play died on 'mount.nfs4: Connection refused' (run 31645153977, job 94280126636).

Gating on the include_role instead keeps every host on the same loop, so one block per item is inserted in loop order. This is what cli/build/include emitted before 351b64e2c: the when on the include_role, the flush unconditional behind it.

Reproduced with a four-host probe -- server host last inverts the order, gating one level down restores it. In run 31543714113 'setup svc-storage-nfs-server' ran 3 times; in 31645153977 it never ran.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tasks/utils/setup/group.yml

@@ -1,7 +1,6 @@
 ---
 - name: "🧩 setup {{ role_group }} roles in run_after order"
   ansible.builtin.include_tasks: ./tasks/utils/setup/role.yml
-  when: (role_entry.app | application_allowed(group_names, lookup('deployment').whitelist))
   loop: "{{ lookup('group_roles', role_group) }}"
   loop_control:
     loop_var: role_entry

tasks/utils/setup/role.yml

@@ -2,6 +2,7 @@
 - name: "🔧 setup {{ role_entry.app }}"
   ansible.builtin.include_role:
     name: "{{ role_entry.role }}"
+  when: (role_entry.app | application_allowed(group_names, lookup('deployment').whitelist))
 
 - name: "🚿 flush handlers after {{ role_entry.app }}"
   ansible.builtin.meta: flush_handlers