[section 5] Ensure pam update is triggered (WIP)

[bykvaadm]

Example of notification improvement.
Why?
if for any reason we can't run role to the end, pam update will never be triggered.
so it's not idempotent without somehow rerunning notifications

[frederickw082922]

Thanks for working on this @bykvaadm.

The approach of checking for existing pam_unix entries before template deployment and using changed_when: true to force handler notification is sound. A few observations:

1. The audit tasks in 5.3.2.1 all share the same task name ("Check existing files") — they should have unique names for better debugging
2. The pattern ensures pam-auth-update runs when pam_unix entries are missing, which addresses the interrupted-run scenario

This is a good enhancement. We're tracking it for inclusion.