The target host does not have the op CLI installed, so op invocations
must run on the Semaphore controller (delegate_to: localhost, become:
false — the controller runs rootless). Generated/loaded secrets also
leak into task logs on failure, so mark the three op tasks and the
set_fact tasks with no_log: true.