The idempotent test is only failing on the second run, the reason is, on the first run the wireguard files are created with default permissions, then the wg_portal role update the ACL. On the second run, the wireguard role recognizes the difference in the permissions, and update the files (expectedly), the default ACL then takes place and set the permissions correctly with ACLs On any successive run, the role is idempotent and doesn't update the files again.
This modularity means that each role can be installed in a playbook by itself as long as the other roles exist around it. This also straps the ensure dependency packages exist in any of the roles tasks, they should be moved to their own roles and configured properly if needed.