docs(ha): add Home Assistant maintenance runbook + ha CLI script (W1N-69)

- runbooks/home-assistant-maintenance.md: access pattern (sudo -n -i ha),
  command reference verified on host, recovery ops, families not scripted,
  docs-vs-CLI discrepancies
- runbooks/scripts/ha-maintenance.sh: read-only health/logs + --yes-gated
  update/restart/rebuild/rollback/reboot/backup/restore/app modes
- AGENTS.md: register runbook in table; hosts/hass: access pattern + link

hosts/hass.windy.lan.md

@@ -13,10 +13,20 @@
 | Web UI | `http://hass.windy.lan:8123` (LAN); WAN port-forward `hass` on gw → `:8123` |
 
 Use `hassio` for routine SSH inspection. Key-only login was verified on
-2026-08-13 from the WSL client (`BatchMode=yes`). The `ha` supervisor CLI is
-present (`/usr/bin/ha`) but returns `unauthorized` without a supervisor API
-token; use the web UI or SSH shell for read-only checks unless a token is
-configured out of band.
+2026-08-13 from the WSL client (`BatchMode=yes`).
+
+The `ha` supervisor CLI (`/usr/bin/ha`) authenticates with `SUPERVISOR_TOKEN`.
+Interactive login works because `~hassio/.zprofile` runs `exec sudo -i`, which
+loads a root environment carrying the supervisor API token. Non-interactive
+`ssh hassio 'command'` does not source `.zprofile` and fails with
+`unauthorized: missing or invalid API token`. Run `ha` non-interactively via:
+
+```bash
+ssh -o BatchMode=yes hassio@hass.windy.lan 'sudo -n -i ha core info'
+```
+
+Verified 2026-08-13 that `sudo -n -i ha core info` works from the WSL client.
+Never copy the supervisor token into this repository.
 
 The current SSH ED25519 host-key fingerprint is
 `SHA256:DMcMOgDzFsFTon1fndXowEP7jlyOK3/AX3PVK8BATvk` (verified 2026-08-13).
@@ -99,5 +109,6 @@ getent hosts hass.windy.lan
 
 ## Related docs
 
+- [runbooks/home-assistant-maintenance.md](../runbooks/home-assistant-maintenance.md) — `ha` CLI maintenance runbook + [script](../runbooks/scripts/ha-maintenance.sh)
 - [docs/lan-overview.md](../docs/lan-overview.md) — LAN map and gw port-forward
 - [hosts/dns.windy.lan.md](dns.windy.lan.md) — `hass.windy.lan` / `hass.local` rewrites