fix(samba_reverse_dns): inline reverse-zone list so it survives tag filtering

`Create reverse DNS zones if missing` looped over `samba_reverse_zones`, a fact
built by a separate `set_fact` task that carried no tags. Under a tag-filtered
run (e.g. --tags samba_reverse_dns) that set_fact was skipped, so the variable
was undefined and the play failed:

    TASK [samba_reverse_dns : Create reverse DNS zones if missing]
    'samba_reverse_zones' is undefined

A set_fact must carry the same tags as every task that consumes it. Rather than
re-add tags (which breaks again under any other tag combination), compute the
zone list inline in the loop and drop the now-dead set_fact. The role is now
correct under any tag selection. lan_reverse_zone and k3s_reverse_zones are
defined in group_vars/all/vars.yml, so they are always available.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

infrastructure/roles/samba_reverse_dns/tasks/main.yml

@@ -13,15 +13,15 @@
   changed_when: false
   tags: [samba, samba_reverse_dns]
 
-- name: Build reverse DNS zone list
-  ansible.builtin.set_fact:
-    samba_reverse_zones: >-
-      {{ ([lan_reverse_zone] + (k3s_reverse_zones | default([]))) | unique }}
-
+# The reverse-zone list is computed inline in the loop below rather than via a
+# separate set_fact. A set_fact must carry the same tags as the tasks that
+# consume it, or tag-filtered runs (e.g. --tags samba_reverse_dns) skip it and
+# leave the variable undefined. Inlining removes that cross-task dependency so
+# the role is correct under any tag selection.
 - name: Create reverse DNS zones if missing
   ansible.builtin.command:
     cmd: samba-tool dns zonecreate {{ samba_dns_server }} {{ reverse_zone }} -U Administrator --password={{ samba_dns_admin_pass }}
-  loop: "{{ samba_reverse_zones }}"
+  loop: "{{ ([lan_reverse_zone] + (k3s_reverse_zones | default([]))) | unique }}"
   loop_control:
     loop_var: reverse_zone
   when: reverse_zone not in samba_zones.stdout