ops-exec: gate /pull on a dedicated `artifact` observe grant
ops-exec: document pull_root in the agent config example