fix(access): exclude UCS systems — managed via API not SSH

- tsys-ucs-01/02 moved to EXCLUDE in access-matrix.sh
- Close [#418] — no longer need 2FA removal or SSH key push

Refs [#418]

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

access-matrix.sh

@@ -6,7 +6,7 @@ set -u
 cd /home/reachableceo/projects/PFVCluster || exit 1
 
 # Policy-excluded systems (never attempt access)
-EXCLUDE=':tsys-cloudron:pfv-bms:tsys-umbrel:stlpc-bizoffice:ultix-highside:'
+EXCLUDE=':tsys-cloudron:pfv-bms:tsys-umbrel:tsys-ucs-01:tsys-ucs-02:stlpc-bizoffice:ultix-highside:'
 
 # Determine the SSH user(s) for a given hostname and whether sudo is expected.
 # Returns "user1:user2:...:sudoflag" where sudoflag is "yes" or "no".

bootstrap-all.sh

@@ -62,10 +62,12 @@ run_with_su ultix-field 100.115.233.124 ultixfield ultixfield
 echo "========================================"
 echo "Done. Tell the agent to re-run access-matrix.sh to verify."
 echo "========================================"
-echo "Blocked — need console work (separate tickets):"
-echo "  tsys-ucs-01, tsys-ucs-02 — remove 2FA first [#418]"
+echo "Blocked — need console work (separate ticket):"
 echo "  stlpc-3dscanner — bring online + rename [#417]"
 echo "========================================"
+echo "Excluded (managed via API, not SSH):"
+echo "  tsys-ucs-01, tsys-ucs-02"
+echo "========================================"
 echo "2FA by design (leave alone):"
 echo "  sectestbed-sandbox"
 echo "========================================"