Wrap validate-repo.sh and routine Ansible playbooks with safe-by-default targets: read-only health/audit flows, CONFIRM=1 gates for mutating work, and LIMIT/TARGETS guards. Document entry point in AGENTS.md.