Verwaltung durch Personen (Weg 1), AGENTS.md, project-map.md, known-issues.md

Admin-Schlüssel je Person auf ops (Bastion) aus sites/knaster/proxmox.yaml
(access.ops_ssh_keys/_revoked), Playbook admins.yml, Test, Übergabe in
BETRIEB §15. Einstieg für Agenten und neue Admins: AGENTS.md, Projektkarte,
bekannte Probleme. Weg 2 (Verwaltung über NEX) als Entwurf in Phase 9.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

core/tests/test_artifacts.py

@@ -273,3 +273,17 @@ def test_proxmox_site_consistent_with_registry_and_prometheus():
             assert vm["driver_generation"] == "modern", slot
     vmids = [str(v["vmid"]) for v in vms.values()] + [str(c["vmid"]) for c in site["containers"].values()]
     assert len(vmids) == len(set(vmids))
+
+
+def test_ops_admin_keys_in_site_file():
+    """Weg 1: Admins kommen mit eigenem Schlüssel auf ops (playbooks/admins.yml)."""
+    access = yaml.safe_load((REPO_ROOT / "sites/knaster/proxmox.yaml").read_text())["access"]
+    keys, revoked = access["ops_ssh_keys"], access["ops_ssh_keys_revoked"]
+    assert keys  # nie leer, sonst sperrt sich die Verwaltung aus
+    names = [k["name"] for k in keys]
+    assert len(names) == len(set(names))
+    for k in [*keys, *revoked]:
+        parts = k["key"].split()
+        assert parts[0] in {"ssh-ed25519", "ssh-rsa"} and len(parts) >= 2, k["name"]
+        assert "PRIVATE" not in k["key"], k["name"]
+    assert not {k["key"].split()[1] for k in keys} & {k["key"].split()[1] for k in revoked}