GentleWatch ops bastion — see /runbooks, /agent/healthz.