feat(agents): add Agent Authority policy + access bootstrap tooling

Add non-negotiable "Agent Authority" section to AGENTS.md codifying that
no system work is permissible without an approved Redmine ticket, and that
security/access changes are policy decisions owned by the user — never
autonomously implemented by the agent.

Also add the access bootstrap toolkit:
- agent-bootstrap.sh: in-guest key + sudo setup (localuser sudo only per policy)
- bootstrap-all.sh: workstation-side push to remaining NO-KEY systems
- access-matrix.sh: full fleet SSH/sudo probe
- probe-ssh.sh, probe-ssh-localuser.sh, probe-ga.sh, pivot-probe.sh,
  ga-push-key.sh: diagnostic scripts used during access audit

Refs [#403]

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

probe-ssh-localuser.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/bash
+# Test SSH (localuser) over Tailscale for the ROOT-FAIL nodes.
+# Format: "tsname tailscale_ip"
+set -u
+cd /home/reachableceo/projects/PFVCluster || exit 1
+# ROOT-FAIL linux nodes (from probe-ssh pass 1), excluding policy-excluded:
+#   tsys-umbrel, tsys-cloudron, devbox-cloudron, pfv-bms (api-only)
+nodes="
+hfnoc-uisp 100.94.188.89
+netbird 100.123.45.23
+pfv-jetson-nano-1 100.82.230.119
+pfv-netinfra-01 100.70.181.72
+pfv-netinfra-02 100.71.171.20
+pfv-proxmox-backup-server 100.114.81.107
+pfvsvrpi 100.91.151.113
+preprod-ca 100.94.119.5
+preprod-cloudron 100.95.69.89
+preprod-hfnoc-uisp 100.77.14.7
+preprod-librenms 100.79.52.34
+preprod-proxmox-datacenter 100.101.250.10
+preprod-proxmox-mailgw 100.114.9.49
+preprod-siem 100.98.162.14
+preprod-voip 100.109.99.109
+sectestbed-ca 100.113.245.124
+sectestbed-cloudron 100.97.140.105
+sectestbed-proxmox-datacenter 100.94.1.34
+sectestbed-proxmox-mailgw 100.117.24.21
+sectestbed-proxmox-pbs 100.127.238.29
+sectestbed-proxmox-pve 100.80.72.71
+sectestbed-sandbox 100.64.20.60
+sectestbed-siem 100.108.121.18
+sectestbed-voip 100.86.176.105
+stlpc-artroom 100.120.77.113
+stlpc-garage 100.72.192.22
+subopi-dev-3 100.64.231.65
+subopi-dev-4 100.65.224.85
+subopi3 100.93.17.77
+tsys-proxmox-datacenter 100.125.183.68
+tsys-siem 100.72.35.113
+tsys-ucs-01 100.109.13.110
+tsys-ucs-02 100.68.10.17
+tsys-voip 100.83.126.67
+ultix-field 100.115.233.124
+"
+echo "$nodes" | while read -r name ip; do
+  [ -n "$name" ] || continue
+  res=$(VM_IP="$ip" VM_USER="localuser" bash tests/remote.sh vm \
+        'echo SSHOK; id -un; (sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO)' </dev/null 2>&1 \
+        | tr '\n' '/' )
+  case "$res" in
+    *SSHOK*) printf '%-28s %-16s LOCALUSER-OK   %s\n' "$name" "$ip" "$res" ;;
+    *)       printf '%-28s %-16s LOCALUSER-FAIL  %s\n' "$name" "$ip" "${res##*/}" ;;
+  esac
+done