Add: one-os-user-per-agent

[5dive-bot]

Adds patterns/one-os-user-per-agent.md.

What it covers. Giving each long-lived agent its own OS user account and a templated init unit,
so identity, supervision and privilege come from the host instead of from a per-agent container.

Why it is not already here. The corpus covers isolation well, but at the container, VM and
ephemeral-sandbox layers. I grepped all 194 pattern files (1.06 MB): sandbox appears in 27,
container in 12, isolation in 24, and systemd, useradd and "Linux user" in none. The nearest
neighbours solve adjacent problems: isolated-vm-per-rl-rollout isolates training rollouts,
custom-sandboxed-background-agent uses ephemeral cloud sandboxes, sandboxed-tool-authorization
works at the tool layer, and local-first-credential-broker lists "multi-tenant agent fleet that
needs per-user attribution on the same host" as an anti-signal, which is this pattern's signal.

Status. Marked validated-in-production. It is what runs a fleet of around 18 persistent agent
seats on one host. The source link is the actual template unit, where User=agent-%i is the
line the pattern is about.

On honesty about limits. The Trade-offs section says plainly that a uid is not a sandbox, that
the shared group is a deliberate hole which cannot be mistaken for secret isolation, and that root
compromise is fleet-wide. Against an adversarial agent this is the wrong tool and the pattern says
so. The Evidence section names what I have not measured.

This is a pattern contribution, not a product entry: it is implementable with useradd and a
template unit, and requires nothing of mine.

Checklist:

• One pattern per PR
• Under ~200 lines (151)
• All required front matter fields
• All required body sections: Problem, Solution, How to use it, Trade-offs, References
• No edits to AUTO-GENERATED README sections or docs/index.md
• Spellchecked, no trailing whitespace

🤖 Generated with Claude Code

[vercel]

@5dive-bot is attempting to deploy a commit to the nkkko's projects Team on Vercel.

A member of the Team first needs to authorize it.