feat: Phase 1 FDA host-operator Role and railiance01 pilot (WP-0009 T02–T07)

Lock DEC-FDA-001 working defaults; add roles/host-operator package with
OS/security and load protocols; scaffold eng-coulomb-railiance01-ho-001
with bound agent, vault, ramp checklists, and Kai quote/ledger.

engagements/pilots/eng-coulomb-railiance01-ho-001/schedule.yml

@@ -0,0 +1,25 @@
+# Duty cadence for eng-coulomb-railiance01-ho-001
+# activity-core wiring optional (Phase 3); manual prepare is enough for Phase 1
+engagement_id: eng-coulomb-railiance01-ho-001
+timezone: Europe/Berlin
+entries:
+  - id: daily-health-load
+    agent: host-operator
+    duty: standard_review
+    protocols:
+      - load-workload-review
+      - k3s-node-health-assessment
+    cadence: daily
+    cron: "0 9 * * 1-5"
+    enabled: false
+    notes: "Enable after ramp_up exit (RU checklist complete)"
+
+  - id: weekly-os-security
+    agent: host-operator
+    duty: deep_assessment
+    protocols:
+      - os-security-pass
+    cadence: weekly
+    cron: "0 10 * * 1"
+    enabled: false
+    notes: "Privileged upgrades remain human-gated even when enabled"