hostwarden-baselinelisted

# hostwarden-baseline Measures a running server against `rules/baseline.md` and closes the gaps the user picks. The pipeline in `rules/first-connection.md` runs first, as everywhere. 1. **Overrides:** keys `hostwarden-baseline` and `baseline`, per `rules/overrides.md`, the host's `# baseline` block included. 2. **Measure.** Take what this session's probes already found — a housekeeping or security run, an onboarding. For the rest, run the check each section of `rules/baseline.md` names, reading only that section of its reference, in as few bundled calls as they allow, and list what is missing, one line per section. A section the host's appliance, platform or role file replaces is measured by that file, and a section one of the host's decisions settles is listed as decided, with the decision's heading. Record the result in the `Baseline check:` line (`rules/baseline.md` → Rendered Versions). 3. **Ask** which to apply, in one question. A section the user turns down with a reason is the moment to offer recording it as a decision (`rules/decisions.md` → Writing one). 4. **Apply** one section at a time, each under the rules `AGENTS.md` → Where the Rest Lives → Before you change something names for it. 5. **SSH Login, SSH CA and Admin Keys:** as `rules/baseline.md` → SSH Login and SSH CA say. 6. **Record** `- Baseline: retrofitted <date>` in the host's memory once every section the user picked is in place and none is missing any