fix(restic): vm-esh-nas off env-file too; infra-ops now provisioned there

Prime bootstrapped infra-ops on vm-esh-nas with playbooks/bootstrap-infra-ops-user.yaml.
It got the fleet-pinned uid/gid 850, NOPASSWD sudo with log_output, the docker
group and a 0700 home. That let playbooks/restic-repository-file.yaml migrate
the last restic host: the live profile matched the repo's pre-change sha,
its units no longer carry the URL, its secrets are vaulted, and the live and repo
profiles now match (a5ea75ea). All eight restic hosts are clean.

The staged helper script is gone, both from Prime's home on the host and from the
repo. The docs that described vm-esh-nas as lkraven-only are updated.

persistent-memory.md

@@ -148,8 +148,8 @@ _As of 2026-09-26 ~1620 PT._
   so the systemd units no longer carry the rest-server password. Secrets are vaulted as
   `<host>/etc/restic/{repository,password}`. `restic.env` is KEPT for manual snippets, so
   **a rotation must update the vault, `restic.env` and `repository`.**
-- **vm-esh-nas is still leaking**, because infra-ops has no account there. Prime runs
-  `ssh -t vm-esh-nas 'sudo bash ~/restic-repofile-migrate.sh'`. Its secrets are not vaulted.
+- **vm-esh-nas done too** (Prime bootstrapped infra-ops there at uid 850, NOPASSWD). **All 8 hosts are clean
+  and vaulted.**
 - The passwords were readable until today, so the rotation (Prime's) remains the real fix.
 
 ### augaman: face recognition for Cicada