enzo: add yokai sandbox user for coding agents

Add a bare `yokai` user (primary group `ikai`) for running coding agents
under a separate UID, isolated from hwebs's files and secrets. yokai has
no privileged group memberships and its own $HOME.

- systemd.tmpfiles creates /srv/git (2770 root:ikai) as a drop dir for the
  agent's local clones, outside ~ so /home/hwebs stays a sealed 700.
- security.sudo lets hwebs drop to yokai without a password (de-escalation
  only, scoped to runAs=yokai; root stays gated).
- hwebs joins the ikai group.

Extensive comments document the local-clones model: yokai owns its clone,
hwebs never runs git inside it, and commits are exchanged by fetching (or
via bundles) and landed on main with squash/rebase/interactive + signing.

Assisted-by: claude-code:claude-opus-4-8

0 files changed, 0 insertions, 0 deletions