Add reusable protocol, wire it in ROLE.yaml, and document the current railiance01 allowlist plus quick commands in the pilot access-plan.
Lock DEC-FDA-001 working defaults; add roles/host-operator package with OS/security and load protocols; scaffold eng-coulomb-railiance01-ho-001 with bound agent, vault, ramp checklists, and Kai quote/ledger.
