feat: Phase 1 FDA host-operator Role and railiance01 pilot (WP-0009 T02–T07)

Lock DEC-FDA-001 working defaults; add roles/host-operator package with
OS/security and load protocols; scaffold eng-coulomb-railiance01-ho-001
with bound agent, vault, ramp checklists, and Kai quote/ledger.

engagements/pilots/eng-coulomb-railiance01-ho-001/vault/memory.md

@@ -0,0 +1,74 @@
+---
+agent: host-operator
+engagement_id: eng-coulomb-railiance01-ho-001
+project: coulomb-railiance01
+last_updated: "2026-07-16"
+session_count: 0
+confidentiality: client_owned
+---
+
+# Host Operator Memory — railiance01 pilot
+
+## Engagement Charter
+
+- **Duty:** Keep railiance01 operational and secure; OS currency; load and workload review
+- **Cadence:** daily health/load (business days); weekly OS/security pass
+- **Change windows:** prefer low-traffic periods; reboot only with human approval
+- **Escalation:** coulomb / railiance human operator (Bernd / on-call as designated)
+- **Out of scope:** app features; other hosts; secret vending
+
+## Project Context
+
+Coulomb ecosystem production host `railiance01` runs k3s and platform workloads
+(including Forgejo/apps per railiance-hosts docs). This engagement is the first
+forward-deployed host-operator pilot (KAIZEN-WP-0009).
+
+## Host Profiles
+
+| hostname | role | typical load | services | last review |
+|----------|------|--------------|----------|-------------|
+| railiance01 | k3s production | _TBD ramp-up_ | k3s, forgejo/apps (inventory) | never |
+
+## OS & Patch State
+
+_Pending first OS security pass (RU-05 / weekly protocol)._
+
+## Security Posture
+
+_Pending first security snapshot (RU-05)._
+
+## Load & Workload Envelope
+
+_Pending first load review (RU-06)._
+
+## Accumulated Findings
+
+_None yet._
+
+## What Worked
+
+_None yet._
+
+## Watch Points
+
+- Single-node production: privileged mistakes have full blast radius
+- DinD / Actions runner privilege model on railiance01 (see railiance-hosts ADRs)
+- Disk growth from images, logs, and backups
+
+## Recurring Findings
+
+_None yet._
+
+## Cleared Issues
+
+_None yet._
+
+## Open Threads
+
+- Complete RU-01 access verification
+- Capture baseline `vault/baselines/railiance01.md`
+- First health + load review report
+
+## Session Log
+
+<!-- YYYY-MM-DD · host(s) · key finding · outcome -->