multica_agent_host: op shim reads the service account token (WDWL-37)

Deliver vault_op_service_account_claude to the agent hosts and install a
role-owned ~multica/.local/bin/op shim that exports OP_SERVICE_ACCOUNT_TOKEN
to /usr/bin/op only. op run / op plugin run get env -u spliced after "--"
so the child never sees the token. The daemon unit is untouched (WDWL-18).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/multica_agent_host/templates/op-shim.sh.j2

@@ -0,0 +1,55 @@
+#!/bin/sh
+# {{ ansible_managed }}
+#
+# 1Password CLI shim for the Multica daemon user (multica_agent_host role,
+# WDWL-37). Reads the service account token from a 0600 file and exports it
+# to {{ multica_op_binary }} only, so it never sits in an agent's shell
+# environment.
+token_file="{{ multica_op_token_file }}"
+
+if [ ! -r "$token_file" ]; then
+    echo "op: no 1Password service account token at $token_file" >&2
+    exit 78
+fi
+IFS= read -r OP_SERVICE_ACCOUNT_TOKEN < "$token_file"
+if [ -z "$OP_SERVICE_ACCOUNT_TOKEN" ]; then
+    echo "op: 1Password service account token file $token_file is empty" >&2
+    exit 78
+fi
+export OP_SERVICE_ACCOUNT_TOKEN
+
+# `op run` (and `op plugin run`) hand their own environment, token included,
+# to the command they start. Find the subcommand, skipping global flags that
+# take a value, and stop at the first `--`.
+sub1=""; sub2=""; skip=0; help=0
+for a in "$@"; do
+    if [ "$skip" = 1 ]; then skip=0; continue; fi
+    case "$a" in
+        --) break ;;
+        -h|--help) help=1 ;;
+        --account|--config|--encoding|--format|--session) skip=1 ;;
+        -*) ;;
+        *) if [ -z "$sub1" ]; then sub1=$a; elif [ -z "$sub2" ]; then sub2=$a; fi ;;
+    esac
+done
+
+if [ "$sub1" = run ] || { [ "$sub1" = plugin ] && [ "$sub2" = run ]; }; then
+    # Rebuild the arguments with `env -u` spliced in after the first `--`, so
+    # the child starts without the token.
+    n=$#; i=0; spliced=0
+    while [ "$i" -lt "$n" ]; do
+        a=$1; shift
+        set -- "$@" "$a"
+        if [ "$spliced" = 0 ] && [ "$a" = "--" ]; then
+            set -- "$@" /usr/bin/env -u OP_SERVICE_ACCOUNT_TOKEN
+            spliced=1
+        fi
+        i=$((i + 1))
+    done
+    if [ "$spliced" = 0 ] && [ "$help" = 0 ]; then
+        echo "op: use 'op run [flags] -- <command>'; the shim needs the '--' to keep the service account token out of <command>" >&2
+        exit 64
+    fi
+fi
+
+exec "{{ multica_op_binary }}" "$@"