ops(esh-nas): infra-ops identity bootstrapped in CT 103 via pct from esh-pve-nas

Prime's ruling 2026-10-13. esh-nas (10.0.50.50) had no infra-ops user, so key
login was refused. The same steps as bootstrap-infra-ops-user.yaml (uid/gid
850, fleet key, NOPASSWD sudoers with log_output and the BULK_DATA carve-out,
visudo-validated) ran inside the container from its host. Verified with a
direct ssh infra-ops@10.0.50.50 and sudo -n whoami = root.

playbooks/esh-nas-infra-ops.yaml

@@ -0,0 +1,23 @@
+# Bootstrap the infra-ops identity INSIDE esh-nas (CT 103 on esh-pve-nas, 10.0.50.50), Prime 2026-10-13 ("set it up").
+# infra-ops could not log into the container (no user), so this runs on the HOST and reaches in with pct.
+#   scripts/elway infra-ops@10.0.50.55 --playbook playbooks/esh-nas-infra-ops.yaml
+# The in-container steps are scripts/oneoff/esh-nas-infra-ops/bootstrap-in-ct.sh (= playbooks/bootstrap-infra-ops-user.yaml).
+vars:
+  ctid: "103"
+steps:
+  - name: Stage the bootstrap script on the host
+    upload:
+      src: scripts/oneoff/esh-nas-infra-ops/bootstrap-in-ct.sh
+      dest: /tmp/esh-nas-bootstrap-infra-ops.sh
+      mode: "0700"
+  - name: Push it into CT {{ ctid }} and run it as root there
+    sudo: true
+    shell: pct push {{ ctid }} /tmp/esh-nas-bootstrap-infra-ops.sh /root/bootstrap-infra-ops.sh --perms 0700 && pct exec {{ ctid }} -- bash /root/bootstrap-infra-ops.sh
+  - name: Remove the staged copies
+    sudo: true
+    shell: pct exec {{ ctid }} -- rm -f /root/bootstrap-infra-ops.sh && rm -f /tmp/esh-nas-bootstrap-infra-ops.sh
+verify:
+  - name: The user and its sudoers file exist in CT {{ ctid }}
+    sudo: true
+    shell: pct exec {{ ctid }} -- sh -c 'id infra-ops && visudo -cf /etc/sudoers.d/infra-ops && grep -q NOPASSWD:ALL /etc/sudoers.d/infra-ops'
+    changed_when: "false"