[geoffmcc]

Summary

• Include the Agent Proxy and Agent Scheduler keys in bootstrap-generated secret files.
• Reject raw values for these keys in .env, keeping runtime credentials in protected secret files.

Context

After the security hardening deployment, the Agent and Dashboard could not start when the required proxy secret file was absent. This change makes new bootstrap installs provision both required agent secret files and prevents these values from being configured in plaintext.

Scope

This PR addresses fresh-install/bootstrap configuration only. It does not repair already deployed hosts; existing installations still need the required secret files provisioned securely. It also does not resolve the separate capability-pack isolation/runtime availability issue observed after deployment.

Validation

• git diff --check passed.
• No tests were run for this focused script-only change.

Deployment notes

For existing deployments, provision the required secret files with correct ownership and restrictive permissions before restarting the Agent and Dashboard services. Do not put secret values in .env.