Docs: LXC deployment guide, remote POSIX transport in the executor contract

deploy-lxc.md: Debian 12 packages, vault client + identity, Warpgate host key
(pinned by the identity), helper scripts and protocol file, all-remote config,
cron under exec --secret-env, logs/heartbeat, adding a terminal.
design.md 9: P1-6 done for Linux/macOS; Windows still on the helper scripts (TODO unify).

README.md

@@ -7,6 +7,6 @@ Plane 看板驱动的通用 agent 调度服务：在 Plane 建工作项并指派
 - 凭据全部经 Agent Vault 注入内存，仓库和配置里只有键名。
 
 ## 使用
-- 契约与扩展：`docs/executor-contract.md`；安装、cron、日志、故障：`docs/runbook.md`
+- 契约与扩展：`docs/executor-contract.md`；安装、cron、日志、故障：`docs/runbook.md`；迁到无 agent CLI 的 LXC：`docs/deploy-lxc.md`
 - 入口：`cli/agentd tick|new|show|comment|state|assign|smoke|check-config`（在 `agent-access.py exec --secret-env …` 下运行）
 - 测试：`python3 -m unittest`（离线，不访问 Plane/win10）