docs: adopt clean PSD replacement model

scripts/test-verify-workspace-install-docs.sh

@@ -70,12 +70,15 @@ grep -Fq 'scripts/prepare-server-pi-state.sh /srv/thothii/pi-state 10001 10001'
   echo "server guide does not initialize nested Pi-state targets before Compose" >&2
   exit 1
 }
-grep -Eq '^sudo install -d -o 10001 -g thothii-ops -m 2750 /srv/thothii$' "$server_guide" || {
+grep -Fq 'sudo install -d -o "$operator_uid" -g 10001 -m 0750 /srv/thothii' "$server_guide" || {
   echo "server operations guide does not set the parent traversal boundary" >&2
   exit 1
 }
 for required in \
-  'thothii-ops' \
+  'does not require or permit creation' \
+  'getent passwd 10001' \
+  'getent group 10001' \
+  'chmod 0600 /srv/thothii/operator/server.env' \
   'THT_BACKUP_ROOT=/srv/thothii-backups' \
   'sessions migrate --yes' \
   '"pending":[]' \
@@ -90,6 +93,12 @@ for required in \
     exit 1
   }
 done
+for forbidden in 'sudo useradd' 'sudo groupadd' 'sudo usermod' 'sudo -u thothii' 'thothii-ops'; do
+  if grep -Fq -- "$forbidden" "$server_guide"; then
+    echo "server operations guide creates or depends on a host identity: $forbidden" >&2
+    exit 1
+  fi
+done
 grep -Fq '"$THT_BIN" --help' "$server_guide" || {
   echo "server guide lacks plain tht --help" >&2
   exit 1
@@ -702,7 +711,10 @@ switch (mutation) {
     changed += "\nFor host-gateway, keep the external service listening on 127.0.0.1.\n";
     break;
   case "server-parent-traversal":
-    changed = original.replace("sudo install -d -o 10001 -g thothii-ops -m 2750 /srv/thothii\n", "");
+    changed = original.replace('sudo install -d -o "$operator_uid" -g 10001 -m 0750 /srv/thothii\n', '');
+    break;
+  case "server-host-account":
+    changed += "\n```sh\nsudo useradd --system --uid 10001 thothii\n```\n";
     break;
   case "server-raw-remove":
     changed += "\n```sh\ndocker rm thothii-core thothii-frontend\n```\n";
@@ -885,6 +897,10 @@ expect_guide_rejected \
   "server parent traversal boundary" verify_server_guide \
   "$root/docs/install/server.md" docs/install/server.md server-parent-traversal \
   "server installation guide does not set parent traversal boundary"
+expect_guide_rejected \
+  "server host account creation" verify_server_guide \
+  "$root/docs/install/server.md" docs/install/server.md server-host-account \
+  "server installation guide creates or depends on a host identity"
 expect_guide_rejected \
   "server raw container removal" verify_server_guide \
   "$root/docs/install/server.md" docs/install/server.md server-raw-remove \