fix(ntp): detect a static networkd assignment at any prefix length

The Arch guard added in the previous commit grepped for the literal
"fd40::123/128" -- the full address/prefixlen from ntp_vip6. A hand-written
[Address] using any other mask (/64, say) would not have matched, the
assert would have passed, and keepalived would have been handed an address
networkd was still assigning.

That fails open, which is the wrong direction for this particular check.
It is detect-only: there is no delete afterwards whose result gets
re-verified, so a miss is silent, and the outcome is the dual-ownership
state the guard exists to prevent.

The Debian path does not share the problem. `ip -6 addr show ... to
<prefix>` matches by range regardless of the prefix length the address was
actually assigned with, and its `ip addr del` -- which IS prefix-sensitive
-- is re-verified by a following assert, so a mismatch there fails loudly.

Now matches the bare address, anchored with \b so it cannot instead hit a
longer address sharing the prefix. Verified both directions:

  grep -rlE 'fd40::123\b' /etc/systemd/network/   on edge-1
    -> /etc/systemd/network/10-enp1s0.40.network  (still detected)
  grep -cE 'fd40::123\b' against 'Address=fd40::1234/64'
    -> 0                                          (no false positive)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ansible/roles/keepalived-ntp/tasks/main.yml

@@ -177,12 +177,22 @@
 #
 # That is the precise failure of 2026-08-04, on the host it happened to, so it
 # fails fast rather than being left to inspection.
+# Matched on the bare address, not the full address/prefixlen, and anchored
+# with \b so it cannot also hit a longer address sharing the prefix (fd40::1234).
+#
+# Searching for the literal "fd40::123/128" would fail open: a hand-written
+# [Address] using any other mask -- /64, say -- would not match, the assert
+# below would pass, and keepalived would be handed an address networkd is
+# still assigning. Since this check is detect-only, with no delete afterwards
+# to catch the mistake, a miss here is silent. The Debian path does not share
+# the problem: `ip -6 addr show ... to <prefix>` matches by range regardless of
+# the assigned prefix length, and its delete is re-verified by assert.
 - name: Detect a static assignment of the service address (systemd-networkd)
   ansible.builtin.command:
     argv:
       - grep
-      - -rl
-      - "{{ keepalived_ntp_vip6 }}"
+      - -rlE
+      - "{{ keepalived_ntp_vip6.split('/')[0] }}\\b"
       - /etc/systemd/network/
   register: keepalived_ntp_static6_networkd
   changed_when: false