[Bug]: Kibana-restart-on-ES-certificate handler checks the wrong host and is gated on full_stack

The handler "Restart kibana if available for elasticsearch certificates" (elasticsearch/handlers/main.yml) iterates the Kibana inventory group and delegates the restart per host — but restart_kibana.yml runs package_facts on the Elasticsearch host (no delegate_to) and then guards the restart with 'kibana' in ansible_facts.packages. So it checks the ES host's packages, not the Kibana host's. Effect: in a split deployment (Kibana on its own host) it never restarts the remote Kibana; it only fires when Kibana is co-located on the ES host.

Two fixes:

• Correct the host mismatch (gather/check package facts on the Kibana host being restarted, or drop the check and rely on the group).
• Drop the elasticstack_full_stack gate. It is redundant: the handler already guards on groups[elasticstack_kibana_group_name] | default([]) | length > 0, so with no Kibana group it is a no-op — in both full-stack and standalone. Removing it is therefore not breaking.

Also worth questioning: whether a Kibana restart is needed at all on an ES certificate change — with an unchanged CA, Kibana keeps trusting ES via the CA and reconnects on its own.

Bug fix → 1.0.0. Part of #531 (removes the full_stack meaning "(D) cross-host handler").

Start with elasticsearch/handlers/main.yml and restart_kibana.yml, tracing which host runs package_facts and how the Kibana group and elasticstack_full_stack conditions interact. Verify the behavior for split Kibana and Elasticsearch deployments, then confirm the handler is a no-op without a Kibana group and decide whether certificate changes require a Kibana restart.