workstation: roster-driven provisioner (SSoT reconcile, additive-only)

t3-provision-users.sh now consumes roster_engine.py: derives accounts + per-tier groups + sticky ports + /etc/ttyd-user-map + dispatch.json from roster.yaml and applies them. ADDITIVE-ONLY for existing users (never strips a group, replaces a home, or re-locks an account) so the hourly timer is always safe. Best-effort tier validation vs live k8s_users: warns on a net-new absent user (emo), aborts only on a real tier conflict, skips when root has no Vault token. DRY_RUN mode for safe testing. Verified on the live host: reproduces dispatch.json content exactly, emo/anca groups + all t3-serve instances unchanged, idempotent, shellcheck-clean; deployed to /usr/local/bin (hourly timer target).

Engine: validate_tiers now returns ValidationIssue(severity) — error=conflict (abort) vs warn=absent (grant pending) — + has_blocking_errors(); 28 pytest cases. setup-devvm.sh redeploys the provisioner for reproducibility.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/workstation/setup-devvm.sh

@@ -63,4 +63,9 @@ for d in skills rules agents commands; do
 done
 log "skel: launcher + tmux + inheritance symlinks (base=$CONFIG_BASE)"
 
+# 6) deploy the roster-driven provisioner to /usr/local/bin (run hourly by
+#    t3-provision-users.timer). Re-deployed here so its logic is reproducible.
+install -m 0755 "$HERE/../t3-provision-users.sh" /usr/local/bin/t3-provision-users
+log "t3-provision-users -> /usr/local/bin/ (roster-driven)"
+
 log "OK (idempotent)"