feat: initial agent identity provisioning automation [#442]

Playwright-based tool for enrolling AI agent identities in Cloudron,
generating API keys via SSO (Gitea/Discourse/Redmine), and storing
all credentials in Bitwarden per-agent collections.

- provision-agent.py: main Playwright automation (Cloudron enroll,
  SSO login, API key generation, verification)
- bw-helper.py: Bitwarden CLI wrapper (password gen, item CRUD,
  TOTP, session management)
- Dockerfile: Playwright v1.52.0 + bw CLI + Python deps
- agents.yaml.example: manifest template for Q3/Q4 agents
- TSYSGroupAIOS framework adopted (hooks, rules engine, Makefile)

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

STATUS.md

@@ -0,0 +1,33 @@
+# STATUS.md — Agent Identity Provisioning
+
+## Current State
+
+**Phase:** Development — building the Playwright automation. Not yet executable (awaiting Cloudron invite links from user).
+
+**Ticket:** [#442](https://projects.knownelement.com/issues/442)
+
+## What's Built
+
+- [x] Repo created: `TSYSGroupCorporate/agent-identity-provisioning`
+- [x] Framework adopted (check-rules.sh, hooks, Makefile)
+- [x] Dockerfile (Playwright v1.52.0 + bw CLI + Python deps)
+- [x] docker-compose.yml
+- [x] agents.yaml.example (manifest template)
+- [ ] provision-agent.py (main Playwright script) — IN PROGRESS
+- [ ] bw-helper.py (BW CLI wrapper) — IN PROGRESS
+- [ ] Shellcheck on all scripts
+- [ ] Install hooks
+- [ ] Initial commit + push
+
+## Blockers
+
+- **User must provide:** Cloudron invite links (manifest), BW account credentials
+- **Discourse admin key:** needed for VP SecOps category creation — assign to vp-techops agent after provisioning
+
+## Inbox
+
+- User wants `bw-run.sh` in TSYSGroupAIOS (DONE — needs commit)
+- Cross-linking audit tracked as #441
+- BW migration of reachableceo keys tracked as #440 (due Aug 19)
+- Discourse admin key → assign to vp-techops agent
+- User will create `coo` Linux account + BW account, then run provisioning from dedicated session