refactor(roles): remove redundant post-task service and package assertions

Eliminate post-verification discovery and assert tasks (service_facts
and package_facts) across all 19 roles and align AGENTS.md.

Ansible's built-in declarative modules (package, service) already enforce
target state natively and abort execution immediately on failure. The
subsequent assertion loops were redundant, added significant runtime
overhead, and produced false positives on non-service systemd units
(.socket, .timer) and service aliases (e.g., dbus.socket failing under
service_facts).

- Remove service_facts and Assert Managed Services Are Active across
  11 service roles (ensure_apache, ensure_cockpit, ensure_dbus,
  ensure_dovecot, ensure_fail2ban, ensure_firewalld, ensure_gitea,
  ensure_mariadb, ensure_podman, ensure_postfix, ensure_timezone).
- Remove package_facts and Assert Managed Packages Are Installed across
  8 package roles (ensure_ansible_prereq, ensure_git, ensure_os_patch,
  ensure_os_upgrade, ensure_repo_epel, ensure_repo_rpmfusion,
  ensure_rsync, ensure_vim).
- Update AGENTS.md Section 8.2, Section 10, and Section 21 to codify
  declarative state enforcement and prohibit redundant post-task
  assertion loops.

roles/ensure_ansible_prereq/tasks/main.yml

@@ -112,22 +112,3 @@
     - Ensure_Ansible_Prereq.Service_Facts
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_ansible_prereq is defined
-    - ensure_ansible_prereq.package_list is defined
-    - ensure_ansible_prereq.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_ansible_prereq is defined
-    - ensure_ansible_prereq.package_list is defined
-    - ensure_ansible_prereq.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_ansible_prereq.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_apache/tasks/main.yml

@@ -225,27 +225,3 @@
     - Ensure_Apache.Service_Reload_Config
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_apache is defined
-    - ensure_apache.service_list is defined
-    - ensure_apache.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_apache is defined
-    - ensure_apache.service_list is defined
-    - ensure_apache.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_apache.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_cockpit/tasks/main.yml

@@ -104,27 +104,3 @@
     label: '{{ item.service }} will be {{ item.state }}'
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_cockpit is defined
-    - ensure_cockpit.service_list is defined
-    - ensure_cockpit.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_cockpit is defined
-    - ensure_cockpit.service_list is defined
-    - ensure_cockpit.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_cockpit.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_dbus/tasks/main.yml

@@ -67,27 +67,3 @@
 
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_dbus is defined
-    - ensure_dbus.service_list is defined
-    - ensure_dbus.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_dbus is defined
-    - ensure_dbus.service_list is defined
-    - ensure_dbus.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_dbus.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_dovecot/tasks/main.yml

@@ -150,27 +150,3 @@
   notify: [Ensure_Dovecot.Package_Facts, Ensure_Dovecot.Service_Facts]
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_dovecot is defined
-    - ensure_dovecot.service_list is defined
-    - ensure_dovecot.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_dovecot is defined
-    - ensure_dovecot.service_list is defined
-    - ensure_dovecot.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_dovecot.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_fail2ban/tasks/main.yml

@@ -130,27 +130,3 @@
     - Ensure_Fail2ban.Service_Reload
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_fail2ban is defined
-    - ensure_fail2ban.service_list is defined
-    - ensure_fail2ban.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_fail2ban is defined
-    - ensure_fail2ban.service_list is defined
-    - ensure_fail2ban.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_fail2ban.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_firewalld/tasks/main.yml

@@ -85,27 +85,3 @@
 
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_firewalld is defined
-    - ensure_firewalld.service_list is defined
-    - ensure_firewalld.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_firewalld is defined
-    - ensure_firewalld.service_list is defined
-    - ensure_firewalld.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_firewalld.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_git/tasks/main.yml

@@ -130,22 +130,3 @@
     - Ensure_Git.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_git is defined
-    - ensure_git.package_list is defined
-    - ensure_git.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_git is defined
-    - ensure_git.package_list is defined
-    - ensure_git.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_git.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_gitea/tasks/main.yml

@@ -216,27 +216,3 @@
     - Ensure_Gitea.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_gitea is defined
-    - ensure_gitea.service_list is defined
-    - ensure_gitea.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_gitea is defined
-    - ensure_gitea.service_list is defined
-    - ensure_gitea.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_gitea.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_mariadb/tasks/main.yml

@@ -232,27 +232,3 @@
   loop: '{{ mariadb_user_list }}'
   loop_control:
     label: '{{ item.name }} will be {{ item.state }}'
-- name: Post Verification Service Discovery
-  when:
-    - ensure_mariadb is defined
-    - ensure_mariadb.service_list is defined
-    - ensure_mariadb.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_mariadb is defined
-    - ensure_mariadb.service_list is defined
-    - ensure_mariadb.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_mariadb.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_os_patch/tasks/main.yml

@@ -91,22 +91,3 @@
   notify: [Ensure_Os_Patch.Package_Facts, Ensure_Os_Patch.Service_Facts]
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_os_patch is defined
-    - ensure_os_patch.package_list is defined
-    - ensure_os_patch.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_os_patch is defined
-    - ensure_os_patch.package_list is defined
-    - ensure_os_patch.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_os_patch.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_os_upgrade/tasks/main.yml

@@ -93,22 +93,3 @@
     - Ensure_Os_Upgrade.Service_Facts
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_os_upgrade is defined
-    - ensure_os_upgrade.package_list is defined
-    - ensure_os_upgrade.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_os_upgrade is defined
-    - ensure_os_upgrade.package_list is defined
-    - ensure_os_upgrade.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_os_upgrade.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_podman/tasks/main.yml

@@ -84,27 +84,3 @@
   ansible.builtin.reboot:
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_podman is defined
-    - ensure_podman.service_list is defined
-    - ensure_podman.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_podman is defined
-    - ensure_podman.service_list is defined
-    - ensure_podman.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_podman.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_postfix/tasks/main.yml

@@ -150,27 +150,3 @@
   notify: [Ensure_Postfix.Package_Facts, Ensure_Postfix.Service_Facts]
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_postfix is defined
-    - ensure_postfix.service_list is defined
-    - ensure_postfix.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_postfix is defined
-    - ensure_postfix.service_list is defined
-    - ensure_postfix.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_postfix.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_repo_epel/tasks/main.yml

@@ -100,22 +100,3 @@
     create: false
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_repo_epel is defined
-    - ensure_repo_epel.package_list is defined
-    - ensure_repo_epel.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_repo_epel is defined
-    - ensure_repo_epel.package_list is defined
-    - ensure_repo_epel.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_repo_epel.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_repo_rpmfusion/tasks/main.yml

@@ -72,22 +72,3 @@
     - Ensure_Repo_Rpmfusion.Service_Facts
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_repo_rpmfusion is defined
-    - ensure_repo_rpmfusion.package_list is defined
-    - ensure_repo_rpmfusion.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_repo_rpmfusion is defined
-    - ensure_repo_rpmfusion.package_list is defined
-    - ensure_repo_rpmfusion.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_repo_rpmfusion.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_rsync/tasks/main.yml

@@ -130,22 +130,3 @@
     - Ensure_Rsync.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_rsync is defined
-    - ensure_rsync.package_list is defined
-    - ensure_rsync.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_rsync is defined
-    - ensure_rsync.package_list is defined
-    - ensure_rsync.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_rsync.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_timezone/tasks/main.yml

@@ -128,27 +128,3 @@
     label: '{{ item.name }} will be {{ item.state }}'
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Service Discovery
-  when:
-    - ensure_timezone is defined
-    - ensure_timezone.service_list is defined
-    - ensure_timezone.service_list is iterable
-  ansible.builtin.service_facts:
-- name: Assert Managed Services Are Active
-  when:
-    - ensure_timezone is defined
-    - ensure_timezone.service_list is defined
-    - ensure_timezone.service_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Service {{ item.name }} is not active"
-    quiet: true
-    that:
-      - >-
-        item.state != 'started' or
-        (ansible_facts['services'][item.name ~ '.service'] is defined and
-        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
-        (ansible_facts['services'][item.name] is defined and
-        ansible_facts['services'][item.name]['state'] == 'running')
-  loop: "{{ ensure_timezone.service_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"

roles/ensure_vim/tasks/main.yml

@@ -130,22 +130,3 @@
     - Ensure_Vim.Service_Restart
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
-- name: Post Verification Package Discovery
-  when:
-    - ensure_vim is defined
-    - ensure_vim.package_list is defined
-    - ensure_vim.package_list is iterable
-  ansible.builtin.package_facts:
-- name: Assert Managed Packages Are Installed
-  when:
-    - ensure_vim is defined
-    - ensure_vim.package_list is defined
-    - ensure_vim.package_list is iterable
-  ansible.builtin.assert:
-    fail_msg: "Package {{ item.name }} is not installed"
-    quiet: true
-    that:
-      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
-  loop: "{{ ensure_vim.package_list }}"
-  loop_control:
-    label: "{{ item.name }} will be verified"