fix: stop masking failed service deploys; trim dead config

The docker_services and systemd_services roles ran their "start the
service" tasks with `failed_when: false`, so a container or unit that
failed to come up still reported the deploy as green. Drop it from both
start tasks so a broken deploy actually fails CI. The compose/unit *copy*
tasks keep `failed_when: false` — that's load-bearing for the
`item is not failed` filter that skips services without a compose/unit file.

Also:
- Remove a duplicate "Template service .env files" task in docker_services
  (second copy used a hardcoded path and didn't register; first one is the
  one the start task reads).
- Don't trigger a full fleet deploy on docs/markdown/workflow-only pushes
  to main — add docs/**, **/*.md and .github/** to paths-ignore.
- Drop the dangling `update-freebsd` Make target (playbook doesn't exist;
  fleet has no FreeBSD hosts).

.github/workflows/deploy-on-merge.yml

@@ -6,6 +6,9 @@ on:
       - main
     paths-ignore:
       - "terraform/**"
+      - "docs/**"
+      - "**/*.md"
+      - ".github/**"
 
 # Serialize fleet deploys so two quick merges can't run Ansible against the
 # same hosts at once. Don't cancel an in-flight deploy mid-run — queue it.

ansible/Makefile

@@ -1,4 +1,4 @@
-.PHONY: deploy deploy-check deploy-host update-all update-linux update-freebsd docker-status reboot ping deps
+.PHONY: deploy deploy-check deploy-host update-all update-linux docker-status reboot ping deps
 
 # Full fleet deploy
 deploy:
@@ -20,10 +20,6 @@ update-all:
 update-linux:
 	ansible-playbook playbooks/update-linux.yml
 
-# Update FreeBSD hosts only (pkg)
-update-freebsd:
-	ansible-playbook playbooks/update-freebsd.yml
-
 # Show Docker container status
 docker-status:
 	ansible-playbook playbooks/docker-status.yml

ansible/roles/docker_services/tasks/main.yml

@@ -17,7 +17,6 @@
   loop: "{{ docker_services | default([]) }}"
   when: lookup('ansible.builtin.fileglob', (docker_services_dir | default(playbook_dir + '/services')) + '/' + item + '/.env.j2') | length > 0
   no_log: true
-  failed_when: false
   register: docker_services_env_files
 
 - name: Copy docker-compose files
@@ -41,16 +40,6 @@
   loop: "{{ docker_services | default([]) }}"
   failed_when: false
 
-- name: Template service .env files
-  ansible.builtin.template:
-    src: "{{ playbook_dir }}/services/{{ item }}/.env.j2"
-    dest: "/opt/docker/{{ item }}/.env"
-    mode: '0600'
-  loop: "{{ docker_services | default([]) }}"
-  when: lookup('ansible.builtin.fileglob', playbook_dir + '/services/' + item + '/.env.j2') | length > 0
-  no_log: true
-  failed_when: false
-
 - name: Start/update docker compose services
   community.docker.docker_compose_v2:
     project_src: "/opt/docker/{{ item.item }}"
@@ -62,4 +51,3 @@
     (docker_services_env_files.results | default([]) |
      selectattr('item', 'equalto', item.item) |
      selectattr('changed', 'equalto', true) | list | length > 0)
-  failed_when: false

ansible/roles/systemd_services/tasks/main.yml

@@ -19,4 +19,3 @@
     enabled: true
   loop: "{{ systemd_services_unit_files.results | default([]) }}"
   when: item is not failed
-  failed_when: false