fix: [nomad-step-4] S4.1 — nomad/jobs/agents.hcl (7 roles, llama, vault-templated bot tokens) (#955)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

vault/roles.yaml

@@ -62,6 +62,14 @@ roles:
     namespace: default
     job_id:    woodpecker-agent
 
+  # ── Agents composite (nomad/jobs/agents.hcl — S4.1) ──────────────────────
+  # Single job running all 7 agent roles. Uses a composite policy
+  # (vault/policies/service-agents.hcl) that unions all bot KV paths.
+  - name:      service-agents
+    policy:    service-agents
+    namespace: default
+    job_id:    agents
+
   # ── Per-agent bots (nomad/jobs/bot-<role>.hcl — land in later steps) ───────
   # job_id placeholders match the policy name 1:1 until each bot's jobspec
   # lands. When a bot's jobspec is added under nomad/jobs/, update the