hostwarden-onboardlisted

# hostwarden-onboard Runs a host's first connection on request, while the user is there, rather than whenever the host is next needed, records what housekeeping and the security audit would otherwise be first to record, and ends with where the host stands against `rules/baseline.md`. A host that already has a `memory.md` gets a full re-probe instead (`rules/os-detection.md` → On subsequent connections): the user asks for one by naming a known host here, to refresh a record they no longer trust or one written before a rule recorded more. **Only in an operations checkout** (`AGENTS.md` → Development or Operations). In a development checkout, say so, name the operations checkout (`rules/server-check-handoff.md` → Find the operations checkout) and stop. ## Workflow 1. **The hosts.** Take them from the argument, or ask. With several, the hosts whose memory, or the caller, names a hypervisor go first, the rest in the order given. A guest of the run that one of them registers keeps its turn, now as a known host: its own connection runs steps 4 to 6 here, and pipeline step 9 (→ The first own login) does not. Where nothing but its host reaches it, its report line says `registered through <host>, not measured`. 2. **Announce each host** in one line before its first command: Onboarding 2/5: pve1.example.com — first connection, read-only Onboarding 3/5: web1.example.com — known host, full re-probe, read-only 3. **Run `rules/first-connection.md`**