multica_agent_host: install the 1Password CLI from 1Password's signed repo (WDWL-37)

Agents get `op` so op:// references resolve at command time and secret
values stay out of prompts and transcripts. Installed per 1Password's
apt instructions (signed-by keyring, debsig policy + keyring,
1password-cli), with the key fingerprint-checked before it is trusted;
EL via their yum repo. multica_op_version pins, "" tracks the repo.
Tag: multica_op.

Optional, default-off hook writes OP_SERVICE_ACCOUNT_TOKEN from the
playbook (ansible-vault) to a 0600 file owned by the daemon user. It is
deliberately not wired into the daemon environment: the user unit
belongs to the multica CLI, and the delivery design is pending.

Rolled out with --tags multica_op to haunted-mansion and spaceship-earth;
second run changed=0, op 2.41.1 as multica, debsig verifies the .deb.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/multica_agent_host/tasks/main.yml

@@ -34,6 +34,16 @@
     - multica_claude_settings | length > 0
   tags: [multica, multica_agents, multica_claude_settings]
 
+- name: 1Password CLI
+  ansible.builtin.import_tasks: op_cli.yml
+  when: multica_op_install | bool
+  tags: [multica, multica_op]
+
+- name: 1Password service account token
+  ansible.builtin.import_tasks: op_token.yml
+  when: multica_op_deliver_token | bool
+  tags: [multica, multica_op]
+
 - name: CLI configuration
   ansible.builtin.import_tasks: config.yml
   tags: [multica, multica_config]