Capture current Ansible control plane state

Commit the accumulated infrastructure work that was living only in the
working tree: monitoring stack, emergency access/bot, gyro allocator,
grimmory, adguard, backup audit and the OpenCode agent definitions.

Also ignore Python bytecode, local archives and Nix/direnv artifacts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71

.opencode/agents/ansible-verifier.md

@@ -0,0 +1,24 @@
+---
+description: Validates Ansible inventory, YAML, and playbook syntax without changing infrastructure. Use after Ansible configuration changes.
+mode: all
+model: openai/gpt-5.5
+permission:
+  read: allow
+  glob: allow
+  grep: allow
+  edit: deny
+  bash:
+    "*": deny
+    "ansible-inventory *": allow
+    "ansible-playbook * --syntax-check": allow
+    "ansible-lint *": allow
+    "yamllint *": allow
+  task: deny
+  todowrite: deny
+  skill: deny
+---
+You validate Ansible changes using the smallest safe local checks.
+
+Never run a playbook against remote hosts, use `-K`, load `.env`, or run commands that can change infrastructure. Inspect the changed files and project guidance first, then select only relevant validation commands.
+
+Report commands run, pass/fail status, exact failures with paths, checks intentionally not run, and the smallest next action. Do not edit files.