ops-exec: give the ops-agent LaunchAgent a PATH that finds tailscale
ops-exec: trusted executor (E1+E2), Sando refactor, thin macOS driver