Session 2 outcome: BW sync fixed, Cloudron 2FA on, all four systems
provisioned for vp-techops with verified API keys. Flows consolidated
into provision-agent.py and documented in the provisioner JOURNAL.md.
Session 3 job: populate agents.yaml invites (plus Cloudron app-access
grants) and run the manifest loop for the remaining five agents.