LXC deployment: live config for agentd-01, oregon rollback config, win10 helpers and board protocol in the repo

- config/agentd.yaml is now the agentd-01 live config (state /var/lib/plane-agentd, logs /var/log/plane-agentd);
  config/agentd.oregon.yaml keeps the oregon dispatcher settings for rollback (cron/agentd-tick.sh uses it).
- cron/agentd-tick-lxc.sh: the LXC cron entry.
- tools/win10/: win10-ps.sh / win10-put.sh (vault client dir via AGENT_ACCESS_HOME); relative helpers_dir
  resolves against the repo, default tools/win10.
- config/protocols/gwent-board-protocol.md: copy of gwent/design/board-protocol.md used in prompts.
- agentd.log_dir (default state_dir).
- smoke --watch: create the item and wait for the scheduled dispatcher instead of ticking locally.

tools/win10/win10-ps.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Run a PowerShell script (passed as $1 text, or a file with -f) on win10 through server-access,
+# encoded as -EncodedCommand so quoting never crosses the relay. Output is UTF-8; progress noise off.
+# AGENT_ACCESS_HOME = directory of the vault client (default ~/.local/share/server-access-client);
+# AGENT_ACCESS_CONFIG = identity URL/file.
+set -euo pipefail
+CLIENT="${AGENT_ACCESS_HOME:-$HOME/.local/share/server-access-client}/agent-access.py"
+CFG="${AGENT_ACCESS_CONFIG:-https://nas.tail9531b.ts.net:8443/identity/agent.json}"
+TIMEOUT="${WIN10_TIMEOUT:-120}"
+if [ "${1:-}" = "-f" ]; then SCRIPT="$(cat "$2")"; else SCRIPT="$1"; fi
+SCRIPT="[Console]::OutputEncoding=[Text.Encoding]::UTF8
+\$ErrorActionPreference='Continue'
+\$ProgressPreference='SilentlyContinue'
+$SCRIPT"
+B64="$(printf '%s' "$SCRIPT" | iconv -f UTF-8 -t UTF-16LE | base64 -w0)"
+if [ "${#B64}" -gt 7600 ]; then echo "encoded command too long (${#B64} > 7600)" >&2; exit 2; fi
+exec python3 -I "$CLIENT" --config "$CFG" run --target win10 --timeout "$TIMEOUT" -- \
+  powershell.exe -NoProfile -NonInteractive -EncodedCommand "$B64" 2> >(grep -v -E '^#< CLIXML|^<Objs|正在准备首次使用模块' >&2)

tools/win10/win10-put.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Upload a local text/binary file to win10: gzip+base64, appended in chunks through the relay,
+# then decoded remotely and verified by SHA-256.
+# usage: win10-put.sh <local-file> <remote-windows-path>
+set -euo pipefail
+HERE="$(cd "$(dirname "$0")" && pwd)"
+LOCAL="$1"; REMOTE="$2"
+TMP="$REMOTE.b64"
+SHA="$(sha256sum "$LOCAL" | cut -d' ' -f1)"
+B64="$(gzip -9c "$LOCAL" | base64 -w0)"
+CHUNK=2400
+"$HERE/win10-ps.sh" "New-Item -ItemType Directory -Force -Path (Split-Path -Parent '$REMOTE') | Out-Null; Set-Content -Path '$TMP' -Value '' -NoNewline -Encoding Ascii; 'reset'" >/dev/null
+TOTAL=$(( (${#B64} + CHUNK - 1) / CHUNK ))
+for ((i=0; i<${#B64}; i+=CHUNK)); do
+  PART="${B64:i:CHUNK}"
+  n=$(( i / CHUNK + 1 ))
+  "$HERE/win10-ps.sh" "Add-Content -Path '$TMP' -Value '$PART' -NoNewline -Encoding Ascii; 'chunk $n/$TOTAL'" | tail -1
+done
+"$HERE/win10-ps.sh" "\$b=[Convert]::FromBase64String((Get-Content -Raw -Encoding Ascii '$TMP'))
+\$ms=New-Object IO.MemoryStream(,\$b)
+\$gz=New-Object IO.Compression.GZipStream(\$ms,[IO.Compression.CompressionMode]::Decompress)
+\$out=New-Object IO.MemoryStream; \$gz.CopyTo(\$out)
+[IO.File]::WriteAllBytes('$REMOTE',\$out.ToArray())
+Remove-Item '$TMP'
+'remote sha256 ' + (Get-FileHash '$REMOTE' -Algorithm SHA256).Hash.ToLower()
+'expected      $SHA'"