- Replace `op item get --fields` with `op read` for secrets
- Change `tags: [<role>]` to `tags: <role>` to match playbook style
- Remove redundant `listen:` from handler, add `changed_when: true`
- Name handler after specific service to match real role convention
- Add last-reviewed frontmatter
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>