Squashed 'roles/pipeline/' changes from 78afffe..c13f726

c13f726 Add optional pipeline operator enrollment

git-subtree-dir: roles/pipeline
git-subtree-split: c13f726a0a846180a1aa95d110b8bbc801edaae5

tests/integration

@@ -31,6 +31,7 @@ baseline_args=(
   -e "dnd_pipeline_prompt_library_repository_url=file://$prompt_library_repository"
   -e "dnd_pipeline_prompt_library_revision=$prompt_library_revision"
   -e "dnd_pipeline_prompt_library_root=$prompt_library_root"
+  -e "{\"dnd_pipeline_operator_users\":[\"$operator_user\"]}"
   -e "{\"dnd_pipeline_secrets\":{\"AUDITA_LLM_API_KEY\":\"$synthetic_audita_api_key\",\"OPENROUTER_API_KEY\":\"$synthetic_notarius_api_key\"}}"
 )
 
@@ -38,8 +39,8 @@ cleanup() {
   exit_status=$?
   trap - EXIT
   /usr/bin/sudo /bin/rm -rf -- "$shared_fixture_root" || true
-  /usr/bin/sudo /usr/sbin/userdel --remove "$operator_user" 2>/dev/null || true
   "$ansible_playbook" -i "$inventory" "${baseline_args[@]}" "$converge" >/dev/null 2>&1 || true
+  /usr/bin/sudo /usr/sbin/userdel --remove "$operator_user" 2>/dev/null || true
   rm -rf -- "$test_tmp"
   exit "$exit_status"
 }
@@ -70,6 +71,7 @@ printf '%s\n' \
   -p "$test_tmp/roles"
 "$ansible_playbook" -i "$inventory" --syntax-check "$converge"
 "$workspace_venv/bin/ansible-lint" --offline --profile production "$converge"
+/usr/bin/sudo /usr/sbin/useradd --create-home --shell /usr/sbin/nologin "$operator_user"
 
 baseline_log="$test_tmp/baseline.log"
 run_converge "$baseline_log" "${baseline_args[@]}"
@@ -116,8 +118,6 @@ grep -Fq 'lane_id: item-registry' "$narratio_effective_config"
 /usr/bin/sudo -u narratio /usr/local/bin/narratio config diff default testing \
   --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs | \
   awk -F '\t' '$1 != "changed" || $2 !~ /\.profile_id$/ { invalid = 1 } END { exit invalid || NR == 0 }'
-/usr/bin/sudo /usr/sbin/useradd --create-home --groups narratio \
-  --shell /usr/sbin/nologin "$operator_user"
 /usr/bin/sudo -u "$operator_user" /usr/local/bin/narratio config validate \
   --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs
 /usr/bin/sudo -u "$operator_user" /usr/local/bin/notarius config validate \