refactor(cis): move OS-specific binary resolution to vars/main.yml

roles/cis/vars/main.yml

@@ -0,0 +1,21 @@
+---
+# OS-specific binary names for CIS permission targets.
+# fusermount3 is the modern name; older distros still use fusermount.
+cis_fusermount_binary: >-
+  {{
+    'fusermount3'
+    if (
+      os in ['archlinux', 'fedora', 'rocky', 'rhel']
+      or (os == 'debian' and (os_version | string) not in ['10', '11'])
+      or (os == 'almalinux')
+    )
+    else 'fusermount'
+  }}
+
+# write.ul is the Debian 11 name; all others use write.
+cis_write_binary: >-
+  {{
+    'write.ul'
+    if (os == 'debian' and (os_version | string) == '11')
+    else 'write'
+  }}