Headless agent ops on dev Azure VMs
BANKED (2026-06-03) — superseded for now by Tailscale SSH (ADR-023 §3.4.6, sv0-infrastructure#120). Designed-and-reviewed plan for FULLY-UNATTENDED headless ops on dev Azure VMs via a GitHub-Actions OIDC run-command workflow (no local secret), with a tighter run-command-only role. Activate at the first-client/compliance/≥3-operator trigger; prod stays on interactive Cloudflare Access SSH.