fix(ansible): ssh-ca reloads the sshd unit that is running

The netbird run (pipeline 14795) failed at the reload: 'Could not find
the requested service sshd.service'. Ubuntu's service_facts list
sshd.service as a not-found alias next to the real ssh.service
(running; disabled because ssh.socket activates it), and the role only
checked that the name exists.

The unit is now the one of sshd.service/ssh.service whose state is
running, asserted to be exactly one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/ssh-ca/tasks/main.yml

@@ -127,13 +127,24 @@
       - "'revokedkeys /etc/ssh/revoked_keys' in ssh_ca_effective_lines"
     fail_msg: "sshd -T does not show the SSH CA settings; another config line takes precedence"
 
-# The unit is sshd.service on Arch and RedHat, ssh.service on Debian. sshd -T
-# only parses the files, so the running daemon is reloaded on every run; a
-# reload keeps open sessions.
+# The unit is sshd.service on Arch and RedHat, ssh.service on Debian/Ubuntu.
+# Ubuntu also lists sshd.service as a not-found alias, so the running one is
+# picked. sshd -T only parses the files, so the running daemon is reloaded on
+# every run; a reload keeps open sessions.
 - name: Read the service list
   ansible.builtin.service_facts:
 
-- name: Reload sshd so the running daemon uses the CA config
-  ansible.builtin.systemd:
-    name: "{{ 'sshd.service' if 'sshd.service' in ansible_facts.services else 'ssh.service' }}"
-    state: reloaded
+- name: Reload the running sshd unit
+  vars:
+    ssh_ca_sshd_units: "{{ ansible_facts.services | dict2items | selectattr('key', 'in', ['sshd.service', 'ssh.service']) | selectattr('value.state', 'equalto', 'running') | map(attribute='key') | list }}"
+  block:
+    - name: Check exactly one sshd unit is running
+      ansible.builtin.assert:
+        that:
+          - ssh_ca_sshd_units | length == 1
+        fail_msg: "Expected one running sshd.service or ssh.service, found {{ ssh_ca_sshd_units }}"
+
+    - name: Reload sshd so the running daemon uses the CA config
+      ansible.builtin.systemd:
+        name: "{{ ssh_ca_sshd_units | first }}"
+        state: reloaded