In the end, The 'when:' at the play level wasn't a valid construct for
ansible. To more easily control which tasks are run based on the
ansible_distribution, the Debian specific tasks have been grouped
together in to a separate file which is then included only if
ansible_distribution is 'Debian'.