multica_agent_host: install the 1Password CLI from 1Password's signed repo (WDWL-37)

Agents get `op` so op:// references resolve at command time and secret
values stay out of prompts and transcripts. Installed per 1Password's
apt instructions (signed-by keyring, debsig policy + keyring,
1password-cli), with the key fingerprint-checked before it is trusted;
EL via their yum repo. multica_op_version pins, "" tracks the repo.
Tag: multica_op.

Optional, default-off hook writes OP_SERVICE_ACCOUNT_TOKEN from the
playbook (ansible-vault) to a 0600 file owned by the daemon user. It is
deliberately not wired into the daemon environment: the user unit
belongs to the multica CLI, and the delivery design is pending.

Rolled out with --tags multica_op to haunted-mansion and spaceship-earth;
second run changed=0, op 2.41.1 as multica, debsig verifies the .deb.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/playbooks/provision-agent-host.yml

@@ -56,6 +56,12 @@
     # Environment variable on the control node:
     # multica_pat: "{{ lookup('env', 'MULTICA_PAT') }}"
 
+    # 1Password service account token for `op`. Off until the service
+    # account exists and the delivery design is agreed (WDWL-37). Same shape as
+    # the PAT: a per-host dictionary in group_vars/all/vault.
+    # multica_op_deliver_token: true
+    # multica_op_service_account_token: "{{ vault_op_service_account_tokens[inventory_hostname_short] }}"
+
   # The role's own PAT assert is no_log, so a missing dictionary entry would
   # surface there only as "censored". This checks key presence, never the
   # value, so its failure can name the host.