feat: clone-and-go remote agent install kit

.env.agent.example

@@ -0,0 +1,20 @@
+# onlyscans remote-agent .env (copy to .env, fill the three AGENT_ values)
+# Values come from the central /agents admin page (Sam provisions them).
+
+# Username of the agent record created at /agents (e.g. chch-1)
+AGENT_IDENTITY=
+
+# The password shown ONCE at agent creation (or after a reset on /agents)
+AGENT_PASSWORD=
+
+# The location NAME this agent scans from (e.g. chch-office)
+AGENT_LOCATION=
+
+# NOT needed — the registry image is publicly pullable. Only fill this if
+# Sam tells you the registry has been re-privatized (then also run:
+# docker login gitea.noctools.nz -u sam -p <this-token>).
+# REGISTRY_TOKEN=
+
+# Optional CVE matching via central API (leave empty unless Sam provides it)
+CVE_MATCH_API=
+CVE_MATCH_TOKEN=