feat: VpEngOps identity + SBOM/GLPI plans wired into lifecycle [#834]

Commits now authored as VpEngOps (vault: creds/vpengops-vpentops);
reachableceo is the human personal account. grind-stack gains `sbom`
(CycloneDX via pinned syft container, run before sweep) per #834;
GLPI catalog entries planned in #835 gated on #801 write access.
AGENTS.md packaging steps extended; questions-v1.md opened for the
founder (netbird scope, SigNoz reopen, SBOM format).

questions-v1.md

@@ -0,0 +1,23 @@
+# Questions — TSYSDevStack-SupportStack-Cloudron
+
+> Agent-authored questions for the founder. Answers inline, newest round at
+> the top; version up per round (questions-v2.md on the next round).
+
+## Round 1 — 2026-09-06 (VpEngOps)
+
+1. ~~**OAM chat access**~~ ANSWERED in ZCode 2026-09-06: "OAM chat" meant the
+   OAM context here in ZCode — no Matrix credential needed. Identity source =
+   vault item `creds/vpengops-vpentops`; commits now authored as VpEngOps.
+
+2. **NetBird ruling scope** — #650 killed rathole ("netbird for all
+   enterprise network access"). Do **Database-Gateway** (#639, landed:
+   HTTPS DB-access proxy) and **Easy-Gate** (#651, landed: briefing-page
+   gateway) fall inside that ruling, or are they distinct enough to keep?
+
+3. **SigNoz reopen?** — with ClickHouse coming to the infra, SigNoz #666's
+   storage blocker dissolves, but its OSS auth is still local-only (SSO is
+   enterprise-gated = SSO-tax kill). Stay closed, or reopen under an
+   explicit local-auth acceptance?
+
+4. **SBOM format** — defaulting to CycloneDX JSON (syft). If the org
+   standard is SPDX, or both formats are wanted, say so on #834.