fix(access): ban guest-agent as access channel — SSH only [#403]

Previous sessions used `qm guest exec` to back-door SSH keys into ~30 VMs,
bypassing sshd's audit trail in an ITAR/CMMC environment. Wire the ban deep
so it cannot recur:

- tests/remote.sh: remove the vm-guest mode + qm-guest-exec path entirely
- scripts/check-rules.sh: rule #11 fails on any `qm guest exec` / `vm-guest`
  pattern in code (scans .sh/.bash/.py; docs may describe the ban freely)
- AGENTS.md: codify "Access-channel policy: SSH only" as non-negotiable;
  add "Questions" rule banning harness question tools (use questions-v1.md)
- tests/vm-validation.sh: drop guest-agent key re-injection; SSH-only
- proxmox/perf/scripts/perf-matrix.sh + deploy-tuned-guests.sh: convert
  guest-agent execution to SSH (vmroot) now that VMs have key + sudo
- bootstrap-all.sh: re-target the 8 remaining locked-out systems with
  correct users/methods; print a console one-liner for publickey-only Pis

Guest-agent remains installable/checkable for Proxmox state visibility —
never as an execution or key-delivery path.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

WORKING.md

@@ -5,4 +5,7 @@ A commit is blocked while any task below remains unchecked.
 
 ## Current Tasks
 
-- [x] Create e1000e offload fix script (repo only, not deployed yet)
+- [x] Wire guest-agent-as-access ban: strip vm-guest from remote.sh, add check-rules.sh rule #11, codify in AGENTS.md [#403]
+- [x] Convert vm-validation.sh + perf-matrix.sh + deploy-tuned-guests.sh from guest-agent to SSH
+- [x] Rewrite bootstrap-all.sh for remaining 8 locked-out systems (user runs interactively)
+- [x] Ban harness question-tool in meta + project AGENTS.md (use questions-v1.md only)