feat(kvb-org-operator): list every command only the operator can run

kvb-org-operator collects the steps that wait on a human across all agents: commands under a deny or unconfirmed ask rule, anything outside the sandbox (keys, permission settings, foreign hosts, root), steps the agent rules reserve for the operator (push, release, tags, reboot) and human-bound ones (hardware key, login, second factor, purchase, decision). Sources are the own session, the kvb-org-rasci register and one message per live peer. Done steps drop out, duplicates merge, the rest is ordered by dependency and printed as a table plus one copyable bash block, then recorded as operator/<slug> register tasks. Agents never run a listed command or hand it to a peer. Operator order 2026-11-03; four descriptions trimmed for the listing budget.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -64,6 +64,7 @@ flowchart LR
   org --> org_artefacts[kvb-org-artefacts]
   org --> org_wsjf[kvb-org-wsjf]
   org --> org_robot[kvb-org-robot]
+  org --> org_operator[kvb-org-operator]
   skill --> skill_dream[kvb-skill-dream]
   skill --> skill_tune[kvb-skill-tune]
   skill --> skill_auto[kvb-skill-auto]
@@ -139,6 +140,7 @@ flowchart LR
     artefacts[kvb-org-artefacts]
     wsjf[kvb-org-wsjf]
     robot[kvb-org-robot]
+    operator[kvb-org-operator]
   end
   subgraph cat_skill [skill]
     dream[kvb-skill-dream]
@@ -190,6 +192,7 @@ flowchart LR
   artefacts --> rasci
   democracy --> wsjf
   wsjf --> rasci
+  operator --> rasci
   dream --> rasci
 
   observe --> triage