there were a lot of services in the non-TPA list that were essentially
managed by TPA and that we were just pretending they are
service-admin-managed. A lot of websites, gitlab, btcpayserver, no one
else is taking care of those when shit hits the fan.

See team#29974

the old query relied on the deprecated lsbdistcodename fact and was
somewhat... complicated

the new query can be modified to make counts based of pretty much any
facts including structured facts