Episode 14: an agent reads the WAF blocks, a script beats it, a human merges

ops-readonly gets two read-only questions, waf_blocked and waf_rule_info. The
rule ids per blocked request are in CrowdSec's alerts, not in its log, and
alerts need machine credentials that can also write, so waf-export.py runs on
the host and the container gets one more read-only mount.

Workflow G lets a local 3B model draft CRS route exclusions as a Forgejo issue.
The model never writes rule syntax, a code node checks every field against the
tool output, the only write permission is an issue in one repo, trusted sources
live in the workflow and the trigger needs a token.

waf-propose.py does the same without a model: 5 of 5 false positives, no
exclusion for an attack, 0.03 s. The model proposed an exclusion for nearly
every attack it saw. Numbers and the traps we hit are in HARDENING.md.

compose.yml

@@ -311,6 +311,8 @@ services:
       - ./logs/caddy:/logs/caddy:ro
       - /var/log/journal:/var/log/journal:ro
       - /var/run/fail2ban:/run/fail2ban:ro
+      # episode 14: WAF alerts as JSON, written on the host by ops-readonly/waf-export.py
+      - /var/lib/ops-readonly/waf:/waf:ro
     networks: [proxy]
 
   # --- CI (episode 2) -- start with: docker compose --profile ci up -d ---