Don't reset Hookshot's crypto store on a run that selects no tags

`tasks/main.yml` opens with a block tagged `reset-hookshot-encryption`, and
Ansible runs tagged tasks unless tags are actually selected. A run that selects
no tags therefore reaches `tasks/reset_encryption.yml`: on a host where the
service does not exist yet it fails outright, and on one where it does it stops
the bridge and resets its crypto store without being asked to.

Users of the playbook are shielded from this only because the documented way to
run it always passes `--tags=setup-all,start`.

Adding `never` makes the block reachable only when its tag is explicitly
selected, which is what `--tags=reset-hookshot-encryption` in
docs/configuring-playbook-bridge-hookshot.md already does - that keeps working
unchanged, as selecting a tag by name overrides `never`.

The Molecule scenario no longer needs its `skip-tags` workaround, which is what
makes this verifiable: the scenario runs with no tags selected, and is green
with the workaround gone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SEH3vxYSQ5SV4N5z61eyGT

roles/custom/matrix-bridge-hookshot/molecule/default/molecule.yml

@@ -24,17 +24,6 @@ provisioner:
   config_options:
     defaults:
       callback_result_format: yaml
-  options:
-    # The role's `tasks/main.yml` opens with a block tagged
-    # `reset-hookshot-encryption`, and Ansible runs tagged tasks unless tags are
-    # actually selected - so a tagless play (which is what Molecule runs) hits
-    # it. It stops `matrix-hookshot.service` before that service exists, which
-    # fails on a fresh host. Skipping the tag is what the playbook effectively
-    # does by always running with `--tags=setup-all,start`.
-    #
-    # `molecule-notest,notest` are Molecule's own defaults, repeated here
-    # because this key replaces them rather than adding to them.
-    skip-tags: molecule-notest,notest,reset-hookshot-encryption
   inventory:
     group_vars:
       all:

roles/custom/matrix-bridge-hookshot/tasks/main.yml

@@ -7,6 +7,12 @@
 ---
 
 - tags:
+    # Resetting the crypto store is destructive and is only ever meant to happen
+    # when explicitly asked for. Without `never`, a playbook run that does not
+    # select tags at all runs this block along with everything else - which fails
+    # on a host where the service does not exist yet, and silently resets the
+    # crypto store on one where it does.
+    - never
     - reset-hookshot-encryption
   block:
     - when: matrix_bridge_hookshot_enabled | bool