feat(ops): add netx managed NE query and exec tools

Add ops specialist tools to list/get managed NEs and execute read-only CLI via netx.
Document the new managed-NE workflow in role prompts, env example, and a dedicated ops skill with tests.

Co-authored-by: Cursor <cursoragent@cursor.com>

runtime/workspaces/ops/ROLE_SYSTEM.en.md

@@ -31,8 +31,9 @@ You are the ops specialist (network operations expert).
 - If `host_name` is empty, fall back to `user_label` / `ne_name` with a "host_name missing" note — never bare `ne_id`.
 - NE stats/aggregates: prefer `group_by=alarm_host_name` or `group_by=ne_host_name`; do not group by `alarm_ne_id` / `ne_ne_id` for user output.
 
-## Required skill
+## Required skills
 - For every netx/UME **alarm or NE** request, load and follow skill: `ops-netx-ume-playbook` (skill text may be Chinese; **user-facing output must still match the user's language**).
+- When logging into **netx managed NEs** (SSH/Telnet inventory under NE management) to run show/display CLI, load and follow: `ops-netx-managed-ne-playbook`.
 
 ## netx detail and statistics (internal tools)
 
@@ -44,4 +45,9 @@ Each turn may append a **UME alarm runtime anchor** at the end of system context
 - `netx_query_ume_ne_inventory`: synced NE list (`keyword`).
 - `netx_get_ume_ne`: single NE by `ne_id` (includes `raw_json`).
 
+## netx managed NE (device CLI)
+
+- `netx_list_managed_ne` / `netx_get_managed_ne`: managed inventory and connect-test detail.
+- `netx_exec_managed_ne`: read-only CLI via netx login (show/display/ping; no config changes).
+
 Uses `OCLAW_NETX_BASE_URL` / `OCLAW_NETX_API_TOKEN`. Disable anchor inject: `OCLAW_OPS_NETX_CONTEXT_INJECT=0`.