feat: add /deploy-plugins webhook route + deploy-plugins script

AGENTS.md

@@ -102,7 +102,7 @@ elsewhere; regenerate from `internal/mcp/` when tools change):
     update_check(check_id, enabled) — enable or disable a health check
     list_checks(entity_slug, enabled) — list health checks with verdict, probe kind
     list_executions(entity_slug, status, limit=25) — cursor-paginated execution history
-    list_entity_sessions(entity_slug) — active Nomos sessions linked to an entity
+    list_entity_sessions(entity_slug) — active agent sessions linked to an entity
     get_dashboard_summary() — fleet overview: counts, health, signals, approvals
     list_approvals(status, entity_slug, limit) — list pending/recent approvals; filter by status (pending, approved, denied) or entity
     decide_approval(approval_id, decision) — approve or deny a pending execution; calls the same API endpoint as the Approve button in the UI
@@ -186,10 +186,10 @@ The DB is the truth. The old wiki files were archived at `archive/knowledge/`
 
 ## 6. Acting on the homelab
 
-- **Read state**: use MCP tools. Nomos (the AI agent) is the primary
-  operator interface — it routes to the MCP tool list in §3 for
-  observe/orient/decide/act.
-- **Actions** (restart, logs, apt, pct exec, or anything else): Nomos calls
+- **Read state**: use MCP tools. dsh (DeepSeek Harness, the TypeScript agent
+  sidecar that replaced Nomos) is the primary operator interface — it routes
+  to the MCP tool list in §3 for observe/orient/decide/act.
+- **Actions** (restart, logs, apt, pct exec, or anything else): dsh calls
   `run` (the general execution primitive) via MCP. `reversible_low`/read-only actions execute
   immediately; `config_mutation` and `destructive` actions are queued for
   operator approval via the App button in the control-room UI or via