multica_agent_host: op shim reads the service account token (WDWL-37)

Deliver vault_op_service_account_claude to the agent hosts and install a
role-owned ~multica/.local/bin/op shim that exports OP_SERVICE_ACCOUNT_TOKEN
to /usr/bin/op only. op run / op plugin run get env -u spliced after "--"
so the child never sees the token. The daemon unit is untouched (WDWL-18).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/multica_agent_host/tasks/op_token.yml

@@ -35,3 +35,47 @@
     mode: "0600"
   no_log: true
   become: true
+
+# --- op shim -----------------------------------------------------------------
+# `op` reads the token only from OP_SERVICE_ACCOUNT_TOKEN. The shim, first on
+# the daemon unit's PATH, exports it for the real binary alone, so agents call
+# plain `op` and the token never enters their shell environment. The daemon
+# unit itself stays the CLI's (WDWL-18).
+
+- name: 1Password token | Create the daemon user's bin directory
+  ansible.builtin.file:
+    path: "{{ multica_op_shim_path | dirname }}"
+    state: directory
+    owner: "{{ multica_user }}"
+    group: "{{ multica_group }}"
+    mode: "0755"
+  become: true
+  when: multica_op_shim | bool
+
+- name: 1Password token | Install the op shim
+  ansible.builtin.template:
+    src: op-shim.sh.j2
+    dest: "{{ multica_op_shim_path }}"
+    owner: root
+    group: root
+    mode: "0755"
+  become: true
+  when: multica_op_shim | bool
+
+# As the daemon user, through its own environment: plain `op` must resolve to
+# the shim, and the token must not be in that environment.
+- name: 1Password token | Check op resolves to the shim as the daemon user
+  ansible.builtin.shell:
+    cmd: 'command -v op; env | grep -c "^OP_SERVICE_ACCOUNT_TOKEN=" || true'
+  become: true
+  become_user: "{{ multica_user }}"
+  environment: "{{ _multica_user_env }}"
+  register: _multica_op_shim_check
+  changed_when: false
+  check_mode: false
+  failed_when: >-
+    _multica_op_shim_check.rc != 0
+    or _multica_op_shim_check.stdout_lines != [multica_op_shim_path, '0']
+  when:
+    - multica_op_shim | bool
+    - not ansible_check_mode