fix(access-matrix): strip MOTD banner from SSH probe output [#403]

The login banner on subopi/pfvsvrpi systems was bleeding into the sudo
check output, making SUDOOK results look garbled and broken. Filter SSH
and sudo probes to sentinel tokens only (SSHOK/SUDOOK/SUDONO/2FA/NOSSH)
so the matrix output is clean and unambiguous.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

WORKING.md

@@ -5,7 +5,11 @@ A commit is blocked while any task below remains unchecked.
 
 ## Current Tasks
 
+(all done — session complete)
+
 - [x] Wire guest-agent-as-access ban: strip vm-guest from remote.sh, add check-rules.sh rule #11, codify in AGENTS.md [#403]
 - [x] Convert vm-validation.sh + perf-matrix.sh + deploy-tuned-guests.sh from guest-agent to SSH
-- [x] Rewrite bootstrap-all.sh for remaining 8 locked-out systems (user runs interactively)
-- [x] Ban harness question-tool in meta + project AGENTS.md (use questions-v1.md only)
+- [x] Rewrite bootstrap-all.sh for remaining 8 locked-out systems
+- [x] Ban harness question-tool in meta (TSYSGroupAIOS) + project AGENTS.md
+- [x] Update Redmine #403 + Discourse #298 audit log
+- [x] Final access probe: 63/67 SSH+sudo working; 3 blocked on unrelated work