fix(runtime): migrate roles to nested system fields

roles/cis/tasks/crypto.yml

@@ -7,6 +7,6 @@
 
 - name: Mask Systemd Services
   ansible.builtin.command: >
-    {{ chroot_command }} systemctl mask {{ 'nftables' if firewall_toolkit == 'iptables' else 'iptables' }} bluetooth rpcbind
+    {{ chroot_command }} systemctl mask {{ 'nftables' if system_cfg.features.firewall.toolkit == 'iptables' else 'iptables' }} bluetooth rpcbind
   register: cis_mask_services_result
   changed_when: cis_mask_services_result.rc == 0