ansible: hoist ldb-tools install to top of play

The apt install task was positioned after the user-create step, so a
failure in create (or anywhere upstream) meant ldb-tools never got
installed. Move the apt task to the very top of the play, before the
cluster-secret lookups, so it always runs first on every invocation.

Drop the duplicate apt task that previously sat just before the
ldbmodify locator.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infrastructure/playbooks/kerberos_trust_setup.yml

@@ -85,6 +85,18 @@
                    | default(vault_samba_dns_admin_pass | default('')), true) }}
 
   tasks:
+    # ------------------------------------------------------------------
+    # 0. Ensure required Debian packages are present
+    #    (ldb-tools provides ldbmodify; we use it later to set UPN/SPN
+    #    on the trust account.)
+    # ------------------------------------------------------------------
+    - name: Ensure ldb-tools is installed (provides ldbmodify)
+      ansible.builtin.apt:
+        name: ldb-tools
+        state: present
+        update_cache: true
+        cache_valid_time: 3600
+
     # ------------------------------------------------------------------
     # 0a. Resolve the ClusterIP of the in-cluster MIT KDC if not provided
     # ------------------------------------------------------------------
@@ -313,13 +325,6 @@
     #    must match what the MIT KDC offers (init_kdc.sh keys the
     #    cross-realm krbtgt with AES256).
     # ------------------------------------------------------------------
-    - name: Ensure ldb-tools is installed (provides ldbmodify)
-      ansible.builtin.apt:
-        name: ldb-tools
-        state: present
-        update_cache: true
-        cache_valid_time: 3600
-
     - name: Locate ldbmodify binary
       ansible.builtin.shell:
         cmd: |