The handler restarted the hardcoded service "ssh", which only exists on
Debian-family distros; on RedHat, Suse, Arch etc. the unit is "sshd",
so any sshd config change would fail there.
Pick the name via a new users_sshd_service_name default keyed off
ansible_facts['os_family'] (overridable for exotic distros). Since
site.yaml runs with gather_facts: false, the role now gathers minimal
facts itself when os_family is missing, tagged always so it also runs
under --tags sshd.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
