Agentless, dependency-free monitoring for the vinhedo fleet

The vinhedo fleet runs on OCI Always Free VMs (1GB RAM / 2 vOCPU each), where a standing monitoring agent’s baseline overhead is a meaningful fraction of the box’s resources. Instead of installing a standard agent (e.g. Prometheus node-exporter), projects-monitor-access-to-OCI grants Projects Monitor narrow, forced-command SSH access to a single hand-rolled shell script (monitor-report) that emits one JSON snapshot per invocation via awk/printf, with no JSON library or long-running process. The dedicated projects_monitor account has no shell access beyond that one forced command, and sudo is scoped to exactly two read-only commands (wg show all dump, reading the WireGuard clients file). This trades the convenience and richer feature set of a standard monitoring agent for zero standing daemon overhead, no listening port, no third-party code running as root, and a minimal, auditable blast radius.