agentic-vps — provision & harden a box for autonomous agentic development

The verb for "make me another machine like the one we just set up." Distilled from the srv1692698 session (BRO-1550). It does not reimplement server hardening — it encodes the capability-preserving model and the lockout-safe staging sequence so a future agent reaches for it instead of re-deriving it.

The one invariant

The box IS the sandbox. Security comes from containing the blast radius (non-root agent user · VPN-only access · snapshot rollback · no long-lived secrets in the agent's reach), not from restricting the agent (no tight egress allowlist, no permission prompts, no seccomp leashes). The agent gets the same freedom it has on a local machine — full sudo, open network, any dep, YOLO mode — because a compromise is contained and reversible, not prevented.