fix: clone URL under noctools org; per-agent env file for second agents; drop -u sam from public fallback

.env.agent.example

@@ -10,10 +10,9 @@ AGENT_PASSWORD=
 # The location NAME this agent scans from (e.g. chch-office)
 AGENT_LOCATION=
 
-# NOT needed — the registry image is publicly pullable. Only fill this if
-# Sam tells you the registry has been re-privatized (then also run:
-# docker login gitea.noctools.nz -u sam -p <this-token>).
-# REGISTRY_TOKEN=
+# NOT needed — the registry image is publicly pullable. If Sam ever tells you
+# the registry has been re-privatized, they will send login instructions
+# together with the agent credentials.
 
 # Optional CVE matching via central API (leave empty unless Sam provides it)
 CVE_MATCH_API=