refactor(cis): align normalization with main project activation gate pattern

roles/cis/tasks/_normalize.yml

@@ -1,4 +1,10 @@
 ---
-- name: Build cis_cfg from defaults and user overrides
+- name: Normalize CIS input
   ansible.builtin.set_fact:
-    cis_cfg: "{{ cis_defaults | combine(cis | default({}), recursive=true) }}"
+    cis_enabled: "{{ cis is defined and (cis is mapping or cis | bool) }}"
+    cis_input: "{{ cis if cis is mapping else {} }}"
+
+- name: Normalize CIS configuration
+  when: cis_enabled and cis_cfg is not defined
+  ansible.builtin.set_fact:
+    cis_cfg: "{{ cis_defaults | combine(cis_input, recursive=True) }}"