multica_agent_host: op shim reads the service account token (WDWL-37)

Deliver vault_op_service_account_claude to the agent hosts and install a
role-owned ~multica/.local/bin/op shim that exports OP_SERVICE_ACCOUNT_TOKEN
to /usr/bin/op only. op run / op plugin run get env -u spliced after "--"
so the child never sees the token. The daemon unit is untouched (WDWL-18).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/playbooks/provision-agent-host.yml

@@ -56,11 +56,12 @@
     # Environment variable on the control node:
     # multica_pat: "{{ lookup('env', 'MULTICA_PAT') }}"
 
-    # 1Password service account token for `op`. Off until the service
-    # account exists and the delivery design is agreed (WDWL-37). Same shape as
-    # the PAT: a per-host dictionary in group_vars/all/vault.
-    # multica_op_deliver_token: true
-    # multica_op_service_account_token: "{{ vault_op_service_account_tokens[inventory_hostname_short] }}"
+    # 1Password service account token for `op` (WDWL-37). One shared token,
+    # vault_op_service_account_claude in group_vars/all/vault, scoped by
+    # 1Password to the agents' vault. The role writes it to a 0600 file and
+    # installs an `op` shim that reads it; it never reaches the daemon unit.
+    multica_op_deliver_token: true
+    multica_op_service_account_token: "{{ vault_op_service_account_claude }}"
 
   # The role's own PAT assert is no_log, so a missing dictionary entry would
   # surface there only as "censored". This checks key presence, never the