chore: remove superseded bootstrap/probe scripts

Consolidate to 3 scripts:
- agent-bootstrap.sh (in-guest)
- bootstrap-all.sh (workstation driver)
- access-matrix.sh (fleet verification)

Removed: probe-ssh.sh, probe-ssh-localuser.sh, ga-push-key.sh,
pivot-probe.sh, probe-ga.sh (one-time diagnostics, superseded by
access-matrix.sh).

ga-push-key.sh

@@ -1,44 +0,0 @@
-#!/usr/bin/bash
-# shellcheck disable=SC2016  # intentional: $vars expand in-guest, not locally
-# ga-push-key.sh — push agent SSH key + NOPASSWD sudo to all GA-OK VMs via guest-agent.
-# Runs from the workstation, routing each call through remote.sh vm-guest on the VM's host.
-set -u
-cd /home/reachableceo/projects/PFVCluster || exit 1
-
-KEY='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIWms/uCXnjjo4KyxHBcYI2TDHe8OZ2wle6W/0hSRQLu reachableceo@ultix-streaming'
-
-INGUEST='for u in root localuser; do getent passwd "$u" >/dev/null || continue; H=$(getent passwd "$u"|cut -d: -f6); mkdir -p "$H/.ssh"; chmod 700 "$H/.ssh"; AK="$H/.ssh/authorized_keys"; touch "$AK"; chmod 600 "$AK"; grep -qF "'"${KEY}"'" "$AK" || echo "'"${KEY}"'" >> "$AK"; chown -R "$u": "$H/.ssh"; done; [ -d /etc/sudoers.d ] && { echo "localuser ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/010-agent; chmod 440 /etc/sudoers.d/010-agent; }; echo PUSHDONE $(hostname)'
-
-# host:vmid list of GA-OK VMs (excluding pfv-bms=100 policy-excluded, ultix-streaming=5111 self)
-pairs="
-pfv-tsys1:101
-pfv-tsys1:102
-pfv-tsys1:104
-pfv-tsys3:313
-pfv-tsys5:500
-pfv-tsys5:5000
-pfv-tsys5:5105
-pfv-tsys5:5106
-pfv-tsys5:5107
-pfv-tsys5:5108
-pfv-tsys5:5109
-pfv-tsys5:5112
-pfv-tsys5:51012
-pfv-tsys5:51013
-pfv-tsys5:53100
-pfv-tsys5:53102
-pfv-tsys6:600
-pfv-tsys6:601
-pfv-tsys6:602
-pfv-tsys6:603
-pfv-tsys7:701
-pfv-tsys7:703
-pfv-tsys7:705
-pfv-tsys7:706
-pfv-tsys9:905
-"
-for p in $pairs; do
-  host="${p%%:*}"; vid="${p##*:}"
-  out=$(PROX_HOST="$host" VM_ID="$vid" GUEST_TIMEOUT=120 bash tests/remote.sh vm-guest "$INGUEST" </dev/null 2>&1)
-  printf '%-12s %-6s %s\n' "$host" "$vid" "${out//$'\n'/ | }"
-done

pivot-probe.sh

@@ -1,38 +0,0 @@
-#!/bin/sh
-# pivot-probe.sh — runs ON a Proxmox host (tsys5).
-# Tests whether THIS host's root key grants SSH (root/localuser) into the
-# GA-NO / no-SSH VMs over Tailscale. Output: "ip name user PIVOT-OK|FAIL reason"
-IPS="
-100.125.183.68:tsys-proxmox-datacenter:105
-100.109.13.110:tsys-ucs-01:108
-100.114.81.107:pfv-proxmox-backup-server:400
-100.77.14.7:preprod-hfnoc-uisp:515
-100.108.121.18:sectestbed-siem:5101
-100.80.72.71:sectestbed-proxmox-pve:5102
-100.94.1.34:sectestbed-proxmox-datacenter:5103
-100.127.238.29:sectestbed-proxmox-pbs:5104
-100.97.140.105:sectestbed-cloudron:51011
-100.117.24.21:sectestbed-proxmox-mailgw:51014
-100.113.245.124:sectestbed-ca:51015
-100.86.176.105:sectestbed-voip:51016
-100.98.162.14:preprod-siem:53101
-100.114.9.49:preprod-proxmox-mailgw:53103
-100.94.119.5:preprod-ca:53104
-100.101.250.10:preprod-proxmox-datacenter:53105
-100.79.52.34:preprod-librenms:53106
-100.109.99.109:preprod-voip:53107
-100.95.69.89:preprod-cloudron:53108
-100.94.188.89:hfnoc-uisp:702
-100.72.35.113:tsys-siem:707
-100.82.30.115:kali-tsys:708
-"
-for line in $IPS; do
-  ip="${line%%:*}"; rest="${line#*:}"; name="${rest%%:*}"; vmid="${rest##*:}"
-  if ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=6 "root@${ip}" 'true' >/dev/null 2>&1; then
-    printf '%s\t%s\t%s\troot\tPIVOT-OK\n' "$ip" "$name" "$vmid"
-  elif ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=6 "localuser@${ip}" 'true' >/dev/null 2>&1; then
-    printf '%s\t%s\t%s\tlocaluser\tPIVOT-OK\n' "$ip" "$name" "$vmid"
-  else
-    printf '%s\t%s\t%s\t-\tPIVOT-FAIL\n' "$ip" "$name" "$vmid"
-  fi
-done

probe-ga.sh

@@ -1,32 +0,0 @@
-#!/bin/sh
-# Fleet probe: for each running VM, report guest-agent status + primary IP.
-# Run on a Proxmox host. Output: "VMID NAME GA-STATUS IP(s)"
-set -u
-qm list 2>/dev/null | awk 'NR>1 && $3=="running" {print $1, $2}' | while read -r vmid name; do
-  [ -n "$vmid" ] || continue
-  if timeout 10 qm agent "$vmid" ping >/dev/null 2>&1; then
-    gastatus="GA-OK"
-    ips=$(timeout 10 qm agent "$vmid" network-get-interfaces 2>/dev/null \
-          | python3 -c '
-import sys, json
-try:
-    data = json.load(sys.stdin)
-except Exception:
-    sys.exit(0)
-seen = []
-for iface in data:
-    ifname = iface.get("name","")
-    if ifname == "lo": continue
-    for a in iface.get("ip-addresses", []):
-        ip = a.get("ip-address","")
-        if ":" in ip: continue
-        if ip.startswith("127."): continue
-        seen.append(ip)
-print(",".join(seen))
-' 2>/dev/null)
-  else
-    gastatus="GA-NO"
-    ips=""
-  fi
-  printf '%s\t%s\t%s\t%s\n' "$vmid" "$name" "$gastatus" "$ips"
-done

probe-ssh-localuser.sh

@@ -1,54 +0,0 @@
-#!/usr/bin/bash
-# Test SSH (localuser) over Tailscale for the ROOT-FAIL nodes.
-# Format: "tsname tailscale_ip"
-set -u
-cd /home/reachableceo/projects/PFVCluster || exit 1
-# ROOT-FAIL linux nodes (from probe-ssh pass 1), excluding policy-excluded:
-#   tsys-umbrel, tsys-cloudron, devbox-cloudron, pfv-bms (api-only)
-nodes="
-hfnoc-uisp 100.94.188.89
-netbird 100.123.45.23
-pfv-jetson-nano-1 100.82.230.119
-pfv-netinfra-01 100.70.181.72
-pfv-netinfra-02 100.71.171.20
-pfv-proxmox-backup-server 100.114.81.107
-pfvsvrpi 100.91.151.113
-preprod-ca 100.94.119.5
-preprod-cloudron 100.95.69.89
-preprod-hfnoc-uisp 100.77.14.7
-preprod-librenms 100.79.52.34
-preprod-proxmox-datacenter 100.101.250.10
-preprod-proxmox-mailgw 100.114.9.49
-preprod-siem 100.98.162.14
-preprod-voip 100.109.99.109
-sectestbed-ca 100.113.245.124
-sectestbed-cloudron 100.97.140.105
-sectestbed-proxmox-datacenter 100.94.1.34
-sectestbed-proxmox-mailgw 100.117.24.21
-sectestbed-proxmox-pbs 100.127.238.29
-sectestbed-proxmox-pve 100.80.72.71
-sectestbed-sandbox 100.64.20.60
-sectestbed-siem 100.108.121.18
-sectestbed-voip 100.86.176.105
-stlpc-artroom 100.120.77.113
-stlpc-garage 100.72.192.22
-subopi-dev-3 100.64.231.65
-subopi-dev-4 100.65.224.85
-subopi3 100.93.17.77
-tsys-proxmox-datacenter 100.125.183.68
-tsys-siem 100.72.35.113
-tsys-ucs-01 100.109.13.110
-tsys-ucs-02 100.68.10.17
-tsys-voip 100.83.126.67
-ultix-field 100.115.233.124
-"
-echo "$nodes" | while read -r name ip; do
-  [ -n "$name" ] || continue
-  res=$(VM_IP="$ip" VM_USER="localuser" bash tests/remote.sh vm \
-        'echo SSHOK; id -un; (sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO)' </dev/null 2>&1 \
-        | tr '\n' '/' )
-  case "$res" in
-    *SSHOK*) printf '%-28s %-16s LOCALUSER-OK   %s\n' "$name" "$ip" "$res" ;;
-    *)       printf '%-28s %-16s LOCALUSER-FAIL  %s\n' "$name" "$ip" "${res##*/}" ;;
-  esac
-done

probe-ssh.sh

@@ -1,15 +0,0 @@
-#!/usr/bin/bash
-# Test SSH (root) over Tailscale to every online Linux node.
-# Routes through remote.sh (the only allowed ssh path). Concise one-line output.
-set -u
-cd /home/reachableceo/projects/PFVCluster || exit 1
-tailscale status 2>/dev/null | awk '$4=="linux" && $0 !~ /offline/ {print $1, $2}' | while read -r ip name; do
-  [ -n "$ip" ] || continue
-  res=$(VM_IP="$ip" VM_USER="root" bash tests/remote.sh vm \
-        'echo SSHOK; id -un; (sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO)' </dev/null 2>&1 \
-        | tr '\n' '/' )
-  case "$res" in
-    *SSHOK*) printf '%-28s %-16s ROOT-OK   %s\n' "$name" "$ip" "$res" ;;
-    *)       printf '%-28s %-16s ROOT-FAIL  %s\n' "$name" "$ip" "${res#/}" ;;
-  esac
-done