fix: clone URL under noctools org; per-agent env file for second agents; drop -u sam from public fallback

docker-compose.agent.yml

@@ -1,5 +1,5 @@
-# onlyscans REMOTE AGENT install kit — run this ON THE REMOTE SITE's
-# docker host. One agent = one location = one vantage.
+# onlyscans REMOTE AGENT install kit (Phase 2) — run this ON THE REMOTE SITE's
+# docker host, NOT on the central box. One agent = one location = one vantage.
 #
 # Prereqs (do these FIRST, on the central instance's web UI):
 #   1. Admin → /agents → create the LOCATION for this site (e.g. "chch-office").
@@ -11,12 +11,16 @@
 #   AGENT_LOCATION) → docker compose -f docker-compose.agent.yml up -d
 # The worker image pulls anonymously from the public registry — no
 # `docker login` needed. (Fallback if the registry is ever re-privatized:
-# Sam issues a gitea read:package token → `docker login gitea.noctools.nz
-# -u sam -p <token>`.)
+# Sam will send login instructions with the kit credentials.)
 # Full walkthrough: README.md in this repo.
-# (Running a SECOND agent on the same box: copy this file, change the project
-# `name:` and `container_name` below — otherwise compose project + container
-# collide with the first agent.)
+# (Running a SECOND agent on the same box: each agent needs its OWN
+# credentials — copy this file to e.g. docker-compose.agent2.yml AND create
+# a second env file (.env-agent2), then run it with
+# `docker compose --env-file .env-agent2 -f docker-compose.agent2.yml up -d`.
+# In the copy, change the project `name:` and `container_name` below —
+# otherwise compose project + container collide with the first agent. Two
+# agents sharing one .env would share one auth record — unsupported and
+# silently wrong.)
 #
 # The agent talks to the central PocketBase over the public tunnel TLS
 # (https://scan-api.noctools.nz) — credentials and results are encrypted in