Finish the buildagent playbook.

Turn sudo on, which makes all those sudo_users actually work.

Add tasks to idempotently start the agent if it's not running