feat: add /deploy-plugins webhook route + deploy-plugins script

internal/config/config.go

@@ -20,7 +20,7 @@ type Config struct {
 
 	// Auth (Phase 2: static bearer tokens + OIDC JWT)
 	APIToken         string // operator/CI bearer token for the REST API
-	MCPBearerToken   string // shared secret for Nomos→API MCP calls
+	MCPBearerToken   string // shared secret for dsh→API MCP calls
 	OIDCIssuer       string // OIDC issuer URL for JWT validation (e.g. https://authentik.example.com/application/o/oikos/)
 	OIDCClientID     string // OIDC client ID (aud claim expected in JWT)
 	OIDCClientSecret string // optional client secret for token endpoint proxy (confidential clients)
@@ -62,7 +62,9 @@ type Config struct {
 	// Learning (Phase 3)
 	LearningInterval time.Duration // pattern extraction interval (default 3600s)
 
-	// Nomos agent entity ID (Phase 4)
+	// Agent entity MCP activity is attributed to (slug agent:nomos, seeded).
+	// dsh calls MCP without per-agent identity, so this static entity is the
+	// attribution anchor.
 	NomosAgentID   string
 	NomosAgentSlug string