feat(siem): fleet rollout tooling — agents + PVE rsyslog forwarding [#335]

deploy-agent.sh (Ubuntu VMs) + deploy-rsyslog.sh (PVE hosts, TCP/514 via
Tailscale). Landed: agents on netinfra-01/02, librenms, awx (7 total
active on manager); rsyslog forwarding verified on all 7 PVE hosts
(persistent 514 sessions on the manager). Deferred: k8s nodes (k8s-chat
coordination), docker json-log caps (needs daemon restart window).
Meat + verification: https://projects.knownelement.com/issues/335#note-4006

AGENTS.md

@@ -363,6 +363,7 @@ oam/                OAM platform tooling (oxidized, unpoller, smokeping, netdisc
                     librenms-agent: check_mk agent + snmp-extend scripts ported from KNELServerBuild [#474])
 proxmox/            Proxmox fleet docs (hardware audit, capacity, storage) + perf tuning (perf/)
 awx/                Ansible AWX deployment (k3s + AWX Operator)
+siem/               Wazuh/SIEM deploy tooling (agents on VMs, rsyslog forwarding on PVE) [#335]
 cmdb/               GLPI/CMDB seed tooling (inventory→CSV converter; design: Discourse t/319, #705)
 tests/              Test suite + VM validation harness + remote.sh SSH chokepoint
 scripts/            Framework: git hooks, rule engine (check-rules.sh), shared lib