ops-exec: gate /pull on a dedicated `artifact` observe grant
ops-exec: document pull_root in the agent config example
ops-exec: pin approved scripts per action on the agent