fix(access): ban guest-agent as access channel — SSH only [#403]

Previous sessions used `qm guest exec` to back-door SSH keys into ~30 VMs,
bypassing sshd's audit trail in an ITAR/CMMC environment. Wire the ban deep
so it cannot recur:

- tests/remote.sh: remove the vm-guest mode + qm-guest-exec path entirely
- scripts/check-rules.sh: rule #11 fails on any `qm guest exec` / `vm-guest`
  pattern in code (scans .sh/.bash/.py; docs may describe the ban freely)
- AGENTS.md: codify "Access-channel policy: SSH only" as non-negotiable;
  add "Questions" rule banning harness question tools (use questions-v1.md)
- tests/vm-validation.sh: drop guest-agent key re-injection; SSH-only
- proxmox/perf/scripts/perf-matrix.sh + deploy-tuned-guests.sh: convert
  guest-agent execution to SSH (vmroot) now that VMs have key + sudo
- bootstrap-all.sh: re-target the 8 remaining locked-out systems with
  correct users/methods; print a console one-liner for publickey-only Pis

Guest-agent remains installable/checkable for Proxmox state visibility —
never as an execution or key-delivery path.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

proxmox/perf/scripts/deploy-tuned-guests.sh

@@ -1,32 +1,36 @@
 #!/usr/bin/bash
-# Deploy tuned inside VMs via qm guest exec (no SSH needed)
-# Uses Proxmox qemu-guest-agent for out-of-band command execution
+# Deploy tuned inside VMs over SSH (sshd is the only approved access channel —
+# see AGENTS.md "Access-channel policy: SSH only"). Formerly used the
+# qemu guest-agent channel; converted to SSH now that all VMs have key + sudo.
 set -uo pipefail
 
 # Profile mapping: most VMs get throughput-performance, k8s/network-sensitive get network-latency
 PROFILE="${1:-throughput-performance}"
+REMOTE_SH="${REMOTE_SH:-$(cd "$(dirname "$0")/../../.." && pwd)/tests/remote.sh}"
+VM_USER="${VM_USER:-localuser}"
 
 deploy_vm() {
   local host="$1" vmid="$2" name="$3"
+  # name is the Tailscale hostname (SSH target); vmid retained for reference.
   echo -n "  VMID $vmid ($name) on $host: "
-  PROX_HOST=$host bash tests/remote.sh prox "
-    # Check if guest agent is available
-    if ! qm guest cmd \$vmid ping >/dev/null 2>&1; then
-      echo 'NO GUEST AGENT - skip'
-      exit 0
-    fi
-    # Install tuned
-    result=\$(qm guest exec \$vmid --timeout 120 -- /bin/sh -c 'DEBIAN_FRONTEND=noninteractive apt-get update -qq 2>/dev/null; DEBIAN_FRONTEND=noninteractive apt-get install -y -qq tuned 2>/dev/null; tuned-adm profile $PROFILE 2>/dev/null; systemctl enable tuned 2>/dev/null; systemctl restart tuned 2>/dev/null; tuned-adm active 2>/dev/null' 2>/dev/null)
-    if echo \"\$result\" | grep -q 'Current active'; then
-      echo \"\$result\" | grep -o 'Current active.*' | head -1
-    else
-      echo 'INSTALL FAILED (apt issue or no network)'
-    fi
-  " 2>&1
+  local result
+  result=$(VM_IP="$name" VM_USER="$VM_USER" bash "$REMOTE_SH" vmroot \
+    "DEBIAN_FRONTEND=noninteractive apt-get update -qq 2>/dev/null; \
+     DEBIAN_FRONTEND=noninteractive apt-get install -y -qq tuned 2>/dev/null; \
+     tuned-adm profile $PROFILE 2>/dev/null; \
+     systemctl enable --now tuned 2>/dev/null; \
+     tuned-adm active 2>/dev/null" </dev/null 2>&1)
+  if echo "$result" | grep -q 'Current active'; then
+    echo "$result" | grep -o 'Current active.*' | head -1
+  elif echo "$result" | grep -qi 'permission denied\|no route\|timed out'; then
+    echo "SSH FAILED (no key/no sudo) — run bootstrap-all.sh first"
+  else
+    echo "INSTALL FAILED (apt issue or no network)"
+  fi
 }
 
 echo "============================================"
-echo "  Deploying tuned ($PROFILE) to VMs"
+echo "  Deploying tuned ($PROFILE) to VMs via SSH"
 echo "============================================"
 echo ""
 
@@ -55,7 +59,7 @@ deploy_vm pfv-tsys6 604 tsys-proxmox-mailgw-01
 echo "--- pfv-tsys7 ---"
 deploy_vm pfv-tsys7 701 pfv-k8s-wnode-tsys7
 deploy_vm pfv-tsys7 702 hfnoc-uisp
-deploy_vm pfv-tsys7 703 rr-middleware-01
+deploy_vm pfv-tsys7 703 pfv-rr-middleware-01
 deploy_vm pfv-tsys7 705 pfv-k8s-cnode2
 deploy_vm pfv-tsys7 706 kali-rd
 deploy_vm pfv-tsys7 707 tsys-siem