Episode 9: an ops triage agent that proposes but never executes

The agent runs in n8n on the box and reaches its model over the mesh from
episode five, so no prompt leaves the network. It gets three read-only tools
(recent commits, monitor status, wiki search) and returns one suggested
action as a field. A switch compares that field against three allowed values,
and only one of them reaches ops-actions, a small runner holding its own
hard-coded allowlists for actions and targets.

Measured while building this: the same prompt injection was harmless in every
place the agent reached through a tool (twenty runs, no hits) and worked every
time it arrived in the alert itself, through a poisoned monitor name (thirteen
of thirteen). The allowlist rejected all thirteen. It guards the action field
only, so the attacker-written summary still reached the wiki unchanged; the
triage note now truncates and strips every field it did not write itself.

.env.example

@@ -70,3 +70,11 @@ RUNNER_UUID=
 #   docker compose exec ntfy ntfy access n8n alerts  write-only
 #   docker compose exec ntfy ntfy access n8n deploys write-only
 # See automation/README.md for the rest.
+
+# --- Episode 9: the ops triage agent ---------------------------------------
+# The shared secret between n8n and the ops-actions runner. Anything that can
+# present this header can ask for a container restart, so treat it like a key:
+#   openssl rand -hex 24
+# The runner still refuses any action or any target that is not on its own
+# hard-coded allowlists, so a leaked token cannot widen the blast radius.
+OPS_ACTIONS_TOKEN=