docs: UFW k3s API admin allowlist procedure for host-operator

Add reusable protocol, wire it in ROLE.yaml, and document the current
railiance01 allowlist plus quick commands in the pilot access-plan.

docs/integrations/forward-deployed-engagement-playbook.md

@@ -131,6 +131,18 @@ kaizen-agentic engagement close-session eng-coulomb-railiance01-ho-001 \
   --success --duty standard_review --summary "..." --time 120 --quality 0.8
 ```
 
+### UFW k3s API admin allowlist
+
+After remediation, port **6443** is allowlist-only. Procedure:
+
+- Role protocol: [`roles/host-operator/protocols/ufw-admin-allowlist.md`](../../roles/host-operator/protocols/ufw-admin-allowlist.md)
+- Pilot table + quick commands: engagement `access-plan.md`
+
+```bash
+curl -4 -s ifconfig.me; echo   # on admin laptop
+ssh railiance01 "sudo ufw allow from <PUBLIC_IP> to any port 6443 proto tcp comment 'k3s-api-admin-<label>'"
+```
+
 ### Open human decisions from pilot (not supplier code)
 
 1. Add RAM and/or temporary swap on railiance01