feat: initial agent identity provisioning automation [#442]

Playwright-based tool for enrolling AI agent identities in Cloudron,
generating API keys via SSO (Gitea/Discourse/Redmine), and storing
all credentials in Bitwarden per-agent collections.

- provision-agent.py: main Playwright automation (Cloudron enroll,
  SSO login, API key generation, verification)
- bw-helper.py: Bitwarden CLI wrapper (password gen, item CRUD,
  TOTP, session management)
- Dockerfile: Playwright v1.52.0 + bw CLI + Python deps
- agents.yaml.example: manifest template for Q3/Q4 agents
- TSYSGroupAIOS framework adopted (hooks, rules engine, Makefile)

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

agents.yaml.example

@@ -0,0 +1,82 @@
+# agents.yaml — Agent identity manifest
+#
+# One entry per AI agent identity. The provisioner reads this file,
+# enrolls each agent in Cloudron, generates API keys, and stores
+# everything in Bitwarden.
+#
+# Generate Cloudron invite links at:
+#   https://tsys-cloudron.knel.net -> Users -> Add User -> copy invite URL
+
+agents:
+  - name: vp-techops
+    display_name: "VP TechOps"
+    priority: Q3
+    cloudron_invite: "https://tsys-cloudron.knel.net/invitation/REPLACE_WITH_TOKEN"
+    systems:
+      gitea:
+        url: https://git.knownelement.com
+        token_name: vp-techops-api
+        scopes: ["api", "repo", "read:org"]
+        orgs: ["KNEL", "TechnicalOperations"]
+      discourse:
+        url: https://community.turnsys.com
+        categories: [74, 20]
+      redmine:
+        url: https://projects.knownelement.com
+        projects: [55, 59]
+        role: Developer
+
+  - name: vp-secops
+    display_name: "VP SecOps"
+    priority: Q3
+    cloudron_invite: "https://tsys-cloudron.knel.net/invitation/REPLACE_WITH_TOKEN"
+    systems:
+      gitea:
+        url: https://git.knownelement.com
+        token_name: vp-secops-api
+        scopes: ["api", "repo", "read:org"]
+        orgs: ["KNEL"]
+      discourse:
+        url: https://community.turnsys.com
+        categories: [74]
+      redmine:
+        url: https://projects.knownelement.com
+        projects: [55]
+        role: Developer
+
+  - name: vp-techcompliance
+    display_name: "VP TechCompliance"
+    priority: Q3
+    cloudron_invite: "https://tsys-cloudron.knel.net/invitation/REPLACE_WITH_TOKEN"
+    systems:
+      gitea:
+        url: https://git.knownelement.com
+        token_name: vp-techcompliance-api
+        scopes: ["api", "repo", "read:org"]
+        orgs: ["KNEL"]
+      discourse:
+        url: https://community.turnsys.com
+        categories: [75]
+      redmine:
+        url: https://projects.knownelement.com
+        projects: [55]
+        role: Developer
+
+  # Q4 agents — enroll in Cloudron only (Phase 1), no system access yet
+  - name: coo
+    display_name: "Chief Operating Officer"
+    priority: Q4
+    cloudron_invite: "https://tsys-cloudron.knel.net/invitation/REPLACE_WITH_TOKEN"
+    systems: {}
+
+  - name: svp-knel
+    display_name: "SVP KNEL"
+    priority: Q4
+    cloudron_invite: "https://tsys-cloudron.knel.net/invitation/REPLACE_WITH_TOKEN"
+    systems: {}
+
+  - name: svp-tctc
+    display_name: "SVP TCTC"
+    priority: Q4
+    cloudron_invite: "https://tsys-cloudron.knel.net/invitation/REPLACE_WITH_TOKEN"
+    systems: {}