I am curious where you would draw the line between "AI military systems" and existing systems in use such as Iron Dome and other algorithm-assisted weapons.
Well, you already watered it down to be a worthless principle when "AI bad" became "AI sometimes bad". OP said "not use AI". Using AI for example in missiles for defence is an offensive weapon as after the defense by the AI you are stronger than without it and you cannot take out missiles without attacking. The point is to attack the enemy's AI system without using AI. Otherwise it's still the same AI versus AI race that will most likely end bad for humans at some point.
Perhaps I'm missing something, but that first dimension seems far from obvious. To continue my Iron Dome example, isn't the system making decisions on its own when intercepting anything it classifies as an incoming ballistic threats?
These are obvious dimensions that need to be considered. Of course there can be discussion as to boundaries drawn in that (here 2-d) space as to 'acceptable' and 'unacceptable'. There may be other dimensions as well, such as 'decision making input sources', etc.
As to your specific example, while system x may have 'full agency (autonomous, willful)', if it is purely 'defensive' in nature, it may indeed fall within acceptable zone.
So if Iron dome launches a rocket in defense it's okay, but that rocket mustn't use AI to find its target? I see your general point, but that's going to be a line that's very hard to draw.