PAD-12: per-terminal transport (direct Tailscale SSH or Warpgate, pre-session fallback, pinned host keys, agent key from Vault), one-call win10 launch and one-call collect, remote call timings, agentd ping

config/agentd.example.yaml

@@ -12,6 +12,8 @@ agentd:
   max_rounds_per_thread: 8              # rebuild the executor thread (with a handoff summary) after this many rounds
   comment_max_chars: 6000
   cli_terminal: oregon                  # identity used by `agentd new/comment/state/assign`
+  # ssh_key: AGENTD_SSH_KEY             # direct-ssh: Vault key / env var of the dedicated private key (default)
+  # ssh_dir: /run/plane-agentd/ssh      # direct-ssh: ControlMaster sockets + generated known_hosts (default state_dir/ssh)
 
 # Plane webhook receiver (`agentd webhook-serve`, docs/runbook.md "Webhook"); leave the section out to run on cron only.
 webhook:
@@ -27,7 +29,10 @@ notify: {kind: none}                  # notification hook: only `none` (no-op) e
 
 terminals:
   win10:
-    transport: warpgate-ssh
+    transport: warpgate-ssh             # or direct-ssh over Tailscale (design §9, docs/deploy-lxc.md "直连 SSH"):
+    # transport: direct-ssh
+    # ssh: {host: 100.123.209.19, user: administrator, port: 22, host_key: "ssh-ed25519 AAAA..."}   # pinned host key
+    # fallback: warpgate-ssh            # used only when the direct path fails before the command ran
     target: win10
     os: windows
     launch: schtasks