multica_agent_host: op shim reads the service account token (WDWL-37)

Deliver vault_op_service_account_claude to the agent hosts and install a
role-owned ~multica/.local/bin/op shim that exports OP_SERVICE_ACCOUNT_TOKEN
to /usr/bin/op only. op run / op plugin run get env -u spliced after "--"
so the child never sees the token. The daemon unit is untouched (WDWL-18).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/multica_agent_host/defaults/main.yml

@@ -158,13 +158,18 @@ multica_op_apt_base_url: "https://downloads.1password.com/linux/debian"
 multica_op_rpm_base_url: "https://downloads.1password.com/linux/rpm/stable"
 
 # Service account token delivery. Off by default. When on, the token is written
-# to multica_op_token_file (0600, owned by the daemon user) and nowhere else.
-# The role does NOT export it into the daemon environment; see the README.
-# Supply the VALUE from the playbook, like multica_pat, e.g.
-#   multica_op_service_account_token: "{{ vault_op_service_account_tokens[inventory_hostname_short] }}"
+# to multica_op_token_file (0600, owned by the daemon user) and read from there
+# by the op shim below. The role does NOT export it into the daemon
+# environment; see the README. Supply the VALUE from the playbook, e.g.
+#   multica_op_service_account_token: "{{ vault_op_service_account_claude }}"
 multica_op_deliver_token: false
 multica_op_service_account_token: ""
 multica_op_token_file: "{{ multica_user_home }}/.config/op-service-account/token"
+# With the token delivered, install a shim at multica_op_shim_path (first on
+# the daemon unit's PATH) that exports the token to multica_op_binary only.
+multica_op_shim: true
+multica_op_shim_path: "{{ multica_user_home }}/.local/bin/op"
+multica_op_binary: /usr/bin/op
 
 # -----------------------------------------------------------------------------
 # Node.js (installed only when a selected agent CLI needs npm)