ansible: idempotency check now uses underscore account name

The _trust_exists probe was still grepping samba-tool user list for
"krbtgt/KNOE.LOCAL" (slash form), but the actual sAMAccountName is
"krbtgt_KNOE.LOCAL" (underscore form, since slash is invalid in
sAMAccountName). _trust_exists was therefore always false, the create
step retried against the existing account on every re-run, and Samba
rejected it as a name collision.

Match against samba_account_name directly so re-runs route through
the setpassword branch instead.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infrastructure/playbooks/kerberos_trust_setup.yml

@@ -175,7 +175,7 @@
 
     - name: Set fact — inter-realm krbtgt user already present
       ansible.builtin.set_fact:
-        _trust_exists: "{{ ('krbtgt/' + trust_realm) in _samba_users.stdout }}"
+        _trust_exists: "{{ samba_account_name in _samba_users.stdout }}"
 
     - name: Report trust pre-existence
       ansible.builtin.debug: