feat(agents): add Agent Authority policy + access bootstrap tooling

Add non-negotiable "Agent Authority" section to AGENTS.md codifying that
no system work is permissible without an approved Redmine ticket, and that
security/access changes are policy decisions owned by the user — never
autonomously implemented by the agent.

Also add the access bootstrap toolkit:
- agent-bootstrap.sh: in-guest key + sudo setup (localuser sudo only per policy)
- bootstrap-all.sh: workstation-side push to remaining NO-KEY systems
- access-matrix.sh: full fleet SSH/sudo probe
- probe-ssh.sh, probe-ssh-localuser.sh, probe-ga.sh, pivot-probe.sh,
  ga-push-key.sh: diagnostic scripts used during access audit

Refs [#403]

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

pivot-probe.sh

@@ -0,0 +1,38 @@
+#!/bin/sh
+# pivot-probe.sh — runs ON a Proxmox host (tsys5).
+# Tests whether THIS host's root key grants SSH (root/localuser) into the
+# GA-NO / no-SSH VMs over Tailscale. Output: "ip name user PIVOT-OK|FAIL reason"
+IPS="
+100.125.183.68:tsys-proxmox-datacenter:105
+100.109.13.110:tsys-ucs-01:108
+100.114.81.107:pfv-proxmox-backup-server:400
+100.77.14.7:preprod-hfnoc-uisp:515
+100.108.121.18:sectestbed-siem:5101
+100.80.72.71:sectestbed-proxmox-pve:5102
+100.94.1.34:sectestbed-proxmox-datacenter:5103
+100.127.238.29:sectestbed-proxmox-pbs:5104
+100.97.140.105:sectestbed-cloudron:51011
+100.117.24.21:sectestbed-proxmox-mailgw:51014
+100.113.245.124:sectestbed-ca:51015
+100.86.176.105:sectestbed-voip:51016
+100.98.162.14:preprod-siem:53101
+100.114.9.49:preprod-proxmox-mailgw:53103
+100.94.119.5:preprod-ca:53104
+100.101.250.10:preprod-proxmox-datacenter:53105
+100.79.52.34:preprod-librenms:53106
+100.109.99.109:preprod-voip:53107
+100.95.69.89:preprod-cloudron:53108
+100.94.188.89:hfnoc-uisp:702
+100.72.35.113:tsys-siem:707
+100.82.30.115:kali-tsys:708
+"
+for line in $IPS; do
+  ip="${line%%:*}"; rest="${line#*:}"; name="${rest%%:*}"; vmid="${rest##*:}"
+  if ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=6 "root@${ip}" 'true' >/dev/null 2>&1; then
+    printf '%s\t%s\t%s\troot\tPIVOT-OK\n' "$ip" "$name" "$vmid"
+  elif ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=6 "localuser@${ip}" 'true' >/dev/null 2>&1; then
+    printf '%s\t%s\t%s\tlocaluser\tPIVOT-OK\n' "$ip" "$name" "$vmid"
+  else
+    printf '%s\t%s\t%s\t-\tPIVOT-FAIL\n' "$ip" "$name" "$vmid"
+  fi
+done