Episode 11: a read-only agent that reads the security logs, one agent vs a crew of three

New: ops-readonly, the read-only twin of the episode 9 ops-actions runner
(fixed question list, three read-only mounts, no docker socket, read_only,
cap_drop ALL). Four role skills in agents/skills/, loaded at run time from
this repo's Forgejo. Two workflows: E (one agent, seven tools, one skill) and
F (three agents, one skill each, the workflow is the orchestrator).

Measured over 20 runs: no run of either variant produced all numbers and
lists correct. The solo agent confuses similar counts and skips a tool; the
crew calls every tool but drops fields at each role boundary. Sharpening the
skill files did not help the crew, it made it worse. Logs are attacker text:
an instruction in a request path is carried into the report as data, not
obeyed, but carried.

Claude-Session: https://claude.ai/code/session_017iP581CYtPfxdZYPPAyWZA

ops-readonly/Dockerfile

@@ -0,0 +1,10 @@
+# ops-readonly (episode 11): the read-only executor behind the security report
+# agents. python3-systemd is the only extra, it reads the host journal through
+# libsystemd from a read-only bind mount. No docker client in here on purpose.
+FROM debian:trixie-slim
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends python3 python3-systemd \
+ && rm -rf /var/lib/apt/lists/*
+COPY reader.py /reader.py
+EXPOSE 8098
+CMD ["python3", "-u", "/reader.py"]