ansible: opt read-only kubectl/samba-tool tasks into --check mode

Ansible --check mode auto-skips command/shell tasks unless they
explicitly opt in via check_mode:false. The two cluster-state lookups
(svc/auth ClusterIP and knoe-kdc-secrets/trust_shared_password) were
silently skipped during dry-run, leaving trust_kdc_ip empty and tripping
the assertion immediately.

Add check_mode:false to the five read-only tasks so a --check run can
still resolve cluster state and report what would change:
  - Resolve trust_kdc_ip from cluster
  - Resolve trust_shared_password from knoe-kdc-secrets
  - samba-tool domain trust list  (idempotency probe)
  - samba-tool domain trust validate
  - samba-tool domain trust show  (smoke print)

The mutating create step (samba-tool domain trust create) keeps the
default behavior - skipped in check mode. validate/show gain a guarded
failed_when so a check-mode dry-run on a host where the trust does not
yet exist does not fail (the create was skipped, so a non-zero rc is
expected). Real runs still fail hard on rc!=0.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infrastructure/playbooks/kerberos_trust_setup.yml

@@ -76,6 +76,7 @@
       register: _kdc_clusterip
       when: trust_kdc_ip == ""
       changed_when: false
+      check_mode: false
 
     - name: Set trust_kdc_ip fact from cluster lookup
       ansible.builtin.set_fact:
@@ -106,6 +107,7 @@
       register: _trust_pw
       when: trust_shared_password == ""
       changed_when: false
+      check_mode: false
       no_log: true
 
     - name: Set trust_shared_password fact from cluster Secret
@@ -140,6 +142,7 @@
       register: _trust_list
       changed_when: false
       failed_when: false
+      check_mode: false
 
     - name: Set fact — trust already present
       ansible.builtin.set_fact:
@@ -202,7 +205,13 @@
       no_log: true
       register: _trust_validate
       changed_when: false
-      failed_when: _trust_validate.rc != 0
+      check_mode: false
+      # In --check mode the create step is skipped, so a missing trust
+      # is expected and shouldn't fail the dry run. In a real run we
+      # always want a non-zero rc to fail.
+      failed_when:
+        - _trust_validate.rc != 0
+        - not (ansible_check_mode and not _trust_exists)
 
     - name: Print trust validation result
       ansible.builtin.debug:
@@ -219,7 +228,10 @@
       no_log: true
       register: _trust_show
       changed_when: false
-      failed_when: _trust_show.rc != 0
+      check_mode: false
+      failed_when:
+        - _trust_show.rc != 0
+        - not (ansible_check_mode and not _trust_exists)
 
     - name: Print trust show output
       ansible.builtin.debug: