fix(web-opt-rdr-domains): resolve Jinja-tagged domains end-to-end

CI job 77797371504 on run 26428080957 crashed with:

  tls lookup: application_id '{{ lookup('env', 'INFINITO_DOMAIN') }}'
  not found in domains mapping

`DOMAIN_PRIMARY` is defined in inventories/development/default.yml:20
as `"{{ lookup('env', 'INFINITO_DOMAIN') }}"`. On Ansible 2.18+ that
string carries a `TrustedAsTemplate` tag (it is an
`_AnsibleTaggedStr`). The constructor at tasks/stages/01_constructor.yml:64
wrapped it in `[ DOMAIN_PRIMARY ] | flatten | map('string') | first`
— the explicit `str()` cast strips the trust tag. The resulting plain
string flowed into `CURRENT_PLAY_REDIRECT_DOMAINS.source` as the
literal text `{{ lookup('env', 'INFINITO_DOMAIN') }}`, was passed
through `domain: "{{ item.source }}"` in
roles/web-opt-rdr-domains/tasks/main.yml:14 (one render pass that
produces untrusted content), and finally reached `as_str(terms[0])`
in plugins/lookup/tls.py:39 unchanged. The tls plugin never templated
its arg, so `resolve_term` looked up the literal Jinja string in the
domains mapping and raised.

Two layers, both necessary:

1. plugins/lookup/tls.py:39 — defensively template `terms[0]` through
   `self._templar` before string-coercion. Mirrors the idiom in
   plugins/lookup/unit_name.py:33 and plugins/lookup/email.py:61. Any
   future caller that hands the plugin an unresolved expression now
   gets it resolved before the domains-map lookup.
2. tasks/stages/01_constructor.yml:64-65 — drop the
   `[ X ] | flatten | map('string') | first` ritual for
   `DOMAIN_PRIMARY` and `DOMAIN_HOMEPAGE`. Both are scalar strings in
   every known inventory (group_vars/all/00_general.yml:41,43 +
   inventories/development/default.yml:20); the over-defensive
   wrapper was the trust-tag stripper. Direct reference preserves the
   tag through `CURRENT_PLAY_REDIRECT_DOMAINS` and every downstream
   consumer.

Downstream consumers audited; all transparent to `_AnsibleTaggedStr`
(it inherits from `str`):
- merge_mapping filter: content-based dict-key compare
- domain_mappings filter: takes `DOMAIN_PRIMARY` directly, no cast
- items2dict(key_name='source', value_name='source'): hashable
- generate_all_domains filter: `isinstance(item, str)` matches
- sys-stk-front-base `when: ... | length > 0`: only counts
- web-opt-rdr-domains -> tls lookup (the failing path): now templates

Coverage: new `test_term_with_unresolved_jinja_is_templated` in
tests/unit/plugins/lookup/test_tls.py verifies the lookup feeds its
first term through the templar. The 12 existing tls tests stay
green. `make test` green across all 5 targets.

Class follow-up (not addressed here): the
`| string` / `| map('string')` cast still strips `TrustedAsTemplate`
elsewhere if a future commit reintroduces it; 12 other lookup
plugins do not yet defensively template their args. A lint guard and
plugin-wide audit will come in separate PRs.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

plugins/lookup/tls.py

@@ -36,7 +36,8 @@ class LookupModule(LookupBase):
                 "tls: one or two terms required: (domain|application_id[, want_path])"
             )
 
-        term = as_str(terms[0])
+        templar = getattr(self, "_templar", None)
+        term = as_str(templar.template(terms[0]) if templar else terms[0])
         if not term:
             raise AnsibleError("tls: term is empty")
 

tests/unit/plugins/lookup/test_tls.py

@@ -122,6 +122,25 @@ class TestTlsResolveLookup(unittest.TestCase):
             self.lookup.run(["unknown.example"], variables=self.base_vars)
         self.assertIn("not found", str(ctx.exception))
 
+    def test_term_with_unresolved_jinja_is_templated(self):
+        class _FakeTemplar:
+            def __init__(self, mapping):
+                self._mapping = mapping
+                self.calls = []
+
+            def template(self, value):
+                self.calls.append(value)
+                return self._mapping.get(value, value)
+
+        fake = _FakeTemplar({"{{ MY_DOMAIN }}": "a.example"})
+        self.lookup._templar = fake
+
+        out = self.lookup.run(["{{ MY_DOMAIN }}"], variables=self.base_vars)[0]
+
+        self.assertEqual(out["application_id"], "web-app-a")
+        self.assertEqual(out["domain"], "a.example")
+        self.assertIn("{{ MY_DOMAIN }}", fake.calls)
+
 
 if __name__ == "__main__":
     unittest.main()