Adds the sysadmin setup recipe to the pi notes: run pi as a dedicated `ops`
user with a tightly controlled sudoers allowlist instead of root, so an agent
can do host work without unbounded privilege.
Includes the AGENTS.md to drop at /home/ops/AGENTS.md. It records that the
allowlist is discovered with `sudo -l` (hostnamectl, reboot, the dnf and
systemctl subcommands, firewall-cmd, the ansible shim, libvirt/virsh and
composer-cli, getfacl/setfacl, osbuild-auto.sh, btrfs scrub) and sets the hard
rule for agents: when a command is not on that list, stop, do not attempt
escalation workarounds, and ask the human to add the exact full-path sudoers
line for review before proceeding.
LLM-Generated: true
ducoterra
8bcee5c17f