The role was reporting "changed" on every run due to:
1. Trailing newline mismatch: ansible command module strips trailing
whitespace from stdout, but slurp preserves it in base64 decode
2. Temp file always copied then deleted, causing spurious changes
Fix by:
- Reading desired config directly from role files (delegate_to: localhost)
- Comparing with `| trim` on both sides to normalize whitespace
- Only copying temp file when config actually needs updating
- Task now only runs when config differs, so changed_when: true is correct
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
