Mejorar idempotencia: usar copy para PEM, agregar changed_when a GPG export

roles/kojira/tasks/main.yaml

@@ -26,9 +26,10 @@
     - { src: "kojira.key", dest: "/etc/pki/koji/kojira.key", mode: "0600" }
 
 - name: "Concatenate certificate and key into a PEM file"
-  ansible.builtin.shell:
-    cmd: "cat /etc/pki/koji/kojira.crt /etc/pki/koji/kojira.key > /etc/pki/koji/kojira.pem"
-    creates: "/etc/pki/koji/kojira.pem"
+  ansible.builtin.copy:
+    content: "{{ lookup('file', '/etc/pki/koji/kojira.crt') }}\n{{ lookup('file', '/etc/pki/koji/kojira.key') }}"
+    dest: "/etc/pki/koji/kojira.pem"
+    mode: "0600"
 
 - name: Start and enable kojira service
   ansible.builtin.service: