feat: Phase 1 FDA host-operator Role and railiance01 pilot (WP-0009 T02–T07)

Lock DEC-FDA-001 working defaults; add roles/host-operator package with
OS/security and load protocols; scaffold eng-coulomb-railiance01-ho-001
with bound agent, vault, ramp checklists, and Kai quote/ledger.

engagements/pilots/eng-coulomb-railiance01-ho-001/vault/baselines/railiance01.md

@@ -0,0 +1,47 @@
+# Baseline — railiance01
+
+**Engagement:** eng-coulomb-railiance01-ho-001
+**Status:** pending first observe session (RU-02)
+**Last captured:** —
+
+## Identity
+
+| Field | Value |
+|-------|-------|
+| Hostname | railiance01 |
+| Inventory | railiance-hosts |
+| Notes | k3s production; forgejo/apps |
+
+## Capture checklist (fill on first session)
+
+```bash
+hostname
+uptime
+uname -a
+cat /etc/os-release
+nproc
+free -h
+df -h
+ss -tuln | head -40
+# if k3s:
+kubectl get node -o wide 2>/dev/null || k3s kubectl get node -o wide 2>/dev/null
+```
+
+## Recorded values
+
+_To be filled during ramp-up._
+
+## Known quirks (from docs, pre-session)
+
+- Forgejo + in-cluster Actions runner documented in railiance-hosts ADR-004
+- State Hub / activity-core historically deployed on this cluster path
+- Access often via ops-bridge from workstation
+
+## Envelope seed
+
+| Metric | Baseline | Notes |
+|--------|----------|-------|
+| Load | | |
+| Memory | | |
+| Disk | | |
+| Top workloads | | |