chore(ansible): the native-services playbook states the deployed source root as a literal twenty times #15687

Raised in review of #15686 against one task, declined there as out of scope, and filed here as the whole finding.

What is repeated

autobot-slm-backend/ansible/playbooks/deploy-native-services.yml states the deployed source root as a literal 20 times, across five plays, in six different shapes:

Each play writes the destination itself with synchronize before reading from it, so there is no correctness bug here today: the path cannot be absent unless the sync failed, and a variable would not change that. This is the SSOT rule applied to a value that is genuinely one value, not a defect report.

Why it was not done in #15686

Two reasons, both worth carrying into whoever picks this up.

It is not a local repetition. #15686 touched two of the twenty. Naming an NPU-only variable for those two would leave one play spelling one path two ways while the other four plays kept the literal — worse for a reader than the uniform literal it replaced. The fix is per playbook, not per task.

It costs guard coverage unless that guard is taught first. scripts/check_ansible_file_references.py resolves ansible values to repo paths only where the value is literally prefixed /opt/autobot/src/, under _FILE_KEYS = ("requirements", "src", "chdir", "creates"). That guard exists for #13744 — which was this playbook's NPU requirements: line pointing at docker/npu-worker/requirements.txt, a path that never existed in the repo, so the documented native NPU deploy installed nothing and still reported success. Templating those values removes them from the guard's population, and its only vacuity floor is plays_read >= 1, so the loss would be silent.

So the guard change is a prerequisite, not a follow-up: it must resolve {{ some_var }}/autobot-npu-worker/requirements.txt before the literals move, or #13744 becomes undetectable again.

Acceptance criteria

• check_ansible_file_references.py resolves a templated deploy-root reference to its repo path, with a test that a wrong path behind the template is still caught — the fix(ansible): NPU play installs from docker/npu-worker/requirements.txt, which does not exist #13744 case, restated against the templated form
• The playbook names the deployed source root once and every one of the 20 sites reads it
• The count of references that guard reports does not fall — quoted in the PR, before and after, since it is the only evidence that coverage survived
• repo_tests/ansible_manifest_resolution.py still derives autobot-npu-worker/requirements.txt for /opt/autobot/autobot-npu-worker/venv (it resolves the templated form through _existing_suffix, so this should hold — assert it rather than assume it)

Related

• fix(deps): make each worker manifest declare what its ansible role installs (#15660, #15671) #15686 / bug(ansible): the NPU worker venv is provisioned two different ways, so its contents depend on which path ran #15671 — where this was raised, and the two requirements:/-c occurrences it touched
• fix(ansible): NPU play installs from docker/npu-worker/requirements.txt, which does not exist #13744 — the wrong-path defect the reference guard was built for, in this same task
• tech-debt(ansible): two pip constraint paths restate the code_source literal instead of deriving it from base_dir #15601 — the override-first, SSOT-derived pattern the constraints paths already follow in the roles