Add production Makefile for routine VPS ops

Wrap validate-repo.sh and routine Ansible playbooks with safe-by-default
targets: read-only health/audit flows, CONFIRM=1 gates for mutating work,
and LIMIT/TARGETS guards. Document entry point in AGENTS.md.

AGENTS.md

@@ -100,6 +100,7 @@ not maintain a second copy of the machine table here.
 | UniFi local-service proxy bypass | [docs/unifi-openclash-localhost.md](docs/unifi-openclash-localhost.md) |
 | UniFi SSO login setting (Ansible) | `cd ansible && ansible-playbook playbooks/unifi-sso.yml --limit unifi` |
 | Routine Ansible operations | [runbooks/ansible-operations.md](runbooks/ansible-operations.md) |
+| Routine make commands | `make help` (wraps `ansible-operations.md` read-only + gated flows) |
 | Issue → mergeable change | [runbooks/issue-to-merge.md](runbooks/issue-to-merge.md) |
 | Fix failing health/playbook run | [runbooks/fix-ci.md](runbooks/fix-ci.md) |
 | Release a reviewed change | [runbooks/release.md](runbooks/release.md) |
@@ -166,4 +167,5 @@ hosts/                 # per-host facts
 runbooks/              # step-by-step ops (README.md = index, _template.md = template)
 docs/                  # upstream refs / design notes / research records (active + archive/)
 scripts/validate-repo.sh  # repo-wide validation (run before merging)
+Makefile               # routine validate / health / gated ansible wrappers
 ```