ops(albok): vh joins every albok read group; macOS withdrawal-test run staged

Prime, 2026-10-09: "vh gets albok-everything". playbooks/nh3-albok-vh-viewer.yaml
joins vh to albok-read, albok-personal and albok-feedback on nh3-albok and
authorizes his four Macs' public keys for vh; verified at a fresh login that
every wing's .browse/ lists and reads.

The withdrawal harness gains a macOS driver (run-mac.sh: every mountable FUSE
backend, a read-only smoke of the real wings, results copied back), env
overrides for a non-container client, and summarize.py. Sanity-checked as vh
from the Linux container before staging.

scripts/oneoff/albok-browse-withdrawal/setup-replica.py

@@ -18,9 +18,11 @@ fetching a reference copy.
 import hashlib
 import json
 import os
+import sys
 import uuid
 
-ROOT = "/home/infra-ops/albok-browse-test/wing"
+# Optional argv[1] places the replica elsewhere (python3 - <root> < setup-replica.py).
+ROOT = sys.argv[1] if len(sys.argv) > 1 else "/home/infra-ops/albok-browse-test/wing"
 COUNT = 60
 SIZE = 1 << 20  # 1 MiB: larger than FUSE readahead, so a late read must reach the server