LXC deployment: live config for agentd-01, oregon rollback config, win10 helpers and board protocol in the repo

- config/agentd.yaml is now the agentd-01 live config (state /var/lib/plane-agentd, logs /var/log/plane-agentd);
  config/agentd.oregon.yaml keeps the oregon dispatcher settings for rollback (cron/agentd-tick.sh uses it).
- cron/agentd-tick-lxc.sh: the LXC cron entry.
- tools/win10/: win10-ps.sh / win10-put.sh (vault client dir via AGENT_ACCESS_HOME); relative helpers_dir
  resolves against the repo, default tools/win10.
- config/protocols/gwent-board-protocol.md: copy of gwent/design/board-protocol.md used in prompts.
- agentd.log_dir (default state_dir).
- smoke --watch: create the item and wait for the scheduled dispatcher instead of ticking locally.

config/agentd.yaml

@@ -1,11 +1,13 @@
-# plane-agentd live configuration on oregon (phase 1). No secrets: token_key values are Vault key names; the tokens
-# are injected by `agent-access.py exec --secret-env KEY=KEY` (see cron/agentd-tick.sh and docs/runbook.md).
+# plane-agentd live configuration on the LXC agentd-01 (/opt/plane-agentd, runs as root; docs/deploy-lxc.md).
+# No secrets: token_key values are Vault key names; the tokens are injected by
+# `agent-access.py exec --secret-env KEY=KEY` (cron/agentd-tick-lxc.sh). Rollback to oregon: config/agentd.oregon.yaml.
 plane: {base_url: https://plane.kappiee.com, workspace: kappiee}
 vault: {client: ~/.local/share/server-access-client/agent-access.py, config: https://nas.tail9531b.ts.net:8443/identity/agent.json}
 
 agentd:
-  state_dir: ~/.gwent-board/agentd     # JSON state, agentd.log, heartbeat.json, local run dirs (runs/)
-  helpers_dir: /home/ubuntu/Documents/wjj/project/gwent-design/tools   # win10-ps.sh / win10-put.sh (Windows terminals only)
+  state_dir: /var/lib/plane-agentd     # JSON state, heartbeat.json, lock
+  log_dir: /var/log/plane-agentd       # agentd.log (cron output: cron.log, same dir)
+  helpers_dir: tools/win10             # win10-ps.sh / win10-put.sh (Windows terminals only); relative = repo
   interval: 120
   max_rounds_per_thread: 8
   comment_max_chars: 6000
@@ -27,9 +29,7 @@ terminals:
     capabilities: [android, game]
     executors: [codex]
   oregon:
-    # remote even though agentd runs on oregon today: the dispatcher is moving to an LXC without agent CLIs
-    # (design §9), so this goes through Warpgate like any other host. `transport: local` + `launch: subprocess`
-    # still works for a dispatcher co-located with its executors.
+    # the dispatcher (LXC, no agent CLIs) reaches oregon through Warpgate like any other host (design §9)
     transport: warpgate-ssh
     target: oregon                      # agent-access.py target name
     os: linux
@@ -70,7 +70,7 @@ projects:
     states: {backlog: Backlog, todo: Todo, running: In Progress, waiting: Waiting, review: Review, done: Done}
     reviewer: oregon
     answerer: oregon
-    protocol_file: /home/ubuntu/Documents/wjj/project/gwent/design/board-protocol.md
+    protocol_file: config/protocols/gwent-board-protocol.md   # relative = repo; refresh from gwent/design/board-protocol.md
     routing:
       by_assignee: {window10: win10, oregon: oregon}
       by_label: