multica_agent_host: install the 1Password CLI from 1Password's signed repo (WDWL-37)

Agents get `op` so op:// references resolve at command time and secret
values stay out of prompts and transcripts. Installed per 1Password's
apt instructions (signed-by keyring, debsig policy + keyring,
1password-cli), with the key fingerprint-checked before it is trusted;
EL via their yum repo. multica_op_version pins, "" tracks the repo.
Tag: multica_op.

Optional, default-off hook writes OP_SERVICE_ACCOUNT_TOKEN from the
playbook (ansible-vault) to a 0600 file owned by the daemon user. It is
deliberately not wired into the daemon environment: the user unit
belongs to the multica CLI, and the delivery design is pending.

Rolled out with --tags multica_op to haunted-mansion and spaceship-earth;
second run changed=0, op 2.41.1 as multica, debsig verifies the .deb.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/multica_agent_host/defaults/main.yml

@@ -138,6 +138,34 @@ multica_agent_cli_catalog:
 # Setting env.DISABLE_AUTOUPDATER: "1" here is what makes the pin hold.
 multica_claude_settings: {}
 
+# -----------------------------------------------------------------------------
+# 1Password CLI (op)
+# -----------------------------------------------------------------------------
+# Lets agents resolve op:// references with `op run` / `op inject` / `op read`,
+# so secret values never pass through a prompt or a transcript. Installed from
+# 1Password's signed apt/yum repository.
+multica_op_install: true
+# "" = whatever the repository serves, upgraded on every run. Set e.g. "2.41.1"
+# to pin. 1Password's apt index carries only the newest build, so a pin older
+# than that cannot be installed on a fresh host.
+multica_op_version: ""
+multica_op_key_url: "https://downloads.1password.com/linux/keys/1password.asc"
+# Code signing for 1Password <codesign@1password.com>. The play refuses a key
+# at multica_op_key_url with any other fingerprint.
+multica_op_key_fingerprint: "3FEF9748469ADBE15DA7CA80AC2D62742012EA22"
+multica_op_debsig_policy_url: "https://downloads.1password.com/linux/debian/debsig/1password.pol"
+multica_op_apt_base_url: "https://downloads.1password.com/linux/debian"
+multica_op_rpm_base_url: "https://downloads.1password.com/linux/rpm/stable"
+
+# Service account token delivery. Off by default. When on, the token is written
+# to multica_op_token_file (0600, owned by the daemon user) and nowhere else.
+# The role does NOT export it into the daemon environment; see the README.
+# Supply the VALUE from the playbook, like multica_pat, e.g.
+#   multica_op_service_account_token: "{{ vault_op_service_account_tokens[inventory_hostname_short] }}"
+multica_op_deliver_token: false
+multica_op_service_account_token: ""
+multica_op_token_file: "{{ multica_user_home }}/.config/op-service-account/token"
+
 # -----------------------------------------------------------------------------
 # Node.js (installed only when a selected agent CLI needs npm)
 # -----------------------------------------------------------------------------