feat: add /deploy-plugins webhook route + deploy-plugins script

scripts/verify-phase6.sh

@@ -1,6 +1,9 @@
 #!/bin/sh
-# End-to-end verification — Phase 6 acceptance criteria (14 checks).
+# End-to-end verification — Phase 6 acceptance criteria (13 checks).
 # Run after deploy or cutover. Exit 0 if all pass, 1 on first failure.
+# The nomos gateway checks were removed with the nomos decommission
+# (plans/2026-08-16-dsh-as-agent-replace-nomos.md section 5); the agent
+# runtime is now dsh, which runs outside this compose stack.
 
 set -e
 
@@ -27,25 +30,16 @@ check "4. Scheduler: check pass"             "http://localhost:8090/api/v1/check
 check "5. Actuator: executions endpoint"     "http://localhost:8090/api/v1/executions" 200
 check "6. Learning: patterns endpoint"       "http://localhost:8090/api/v1/patterns" 200
 check "7. Classifier: risk classes"          "http://localhost:8090/api/v1/policy/risk-classes" 200
-check "8. Nomos: gateway health"            "http://localhost:8092/healthz" 200
-check "9. Secrets: backend available"        "http://localhost:8090/api/v1/export" 200
-check "10. Deploy: events endpoint"          "http://localhost:8090/api/v1/events" 200
-check "11. Knowledge: content search"        "http://localhost:8090/healthz" 200
-check "12. Observability: graph endpoint"    "http://localhost:8090/api/v1/graph" 200
-check "13. Correlation: agent activity"      "http://localhost:8090/api/v1/agent-activity" 200
-check "14. Cutover: blast radius (authentik)" "http://localhost:8090/healthz" 200
-
-# Additional: blast radius with actual data
-echo ""
-echo "--- blast radius (authentik) ---"
-curl -s "http://localhost:8092/query" \
-    -H "Content-Type: application/json" \
-    -d '{"query":"what depends on authentik?"}' \
-    | jq -r '"  entities affected: \(.result | length)"' 2>/dev/null || echo "  (skipped)"
+check "8. Secrets: backend available"        "http://localhost:8090/api/v1/export" 200
+check "9. Deploy: events endpoint"           "http://localhost:8090/api/v1/events" 200
+check "10. Knowledge: content search"        "http://localhost:8090/healthz" 200
+check "11. Observability: graph endpoint"    "http://localhost:8090/api/v1/graph" 200
+check "12. Correlation: agent activity"      "http://localhost:8090/api/v1/agent-activity" 200
+check "13. Cutover: blast radius (authentik)" "http://localhost:8090/healthz" 200
 
 echo ""
 if [ "$FAIL" -eq 0 ]; then
-    echo "=== ALL 14 CHECKS PASSED ==="
+    echo "=== ALL 13 CHECKS PASSED ==="
     exit 0
 else
     echo "=== SOME CHECKS FAILED ==="