docs: mark deployed; record deploy-key + subagent caveats in Current state

AGENTS.md

@@ -82,10 +82,14 @@ revisit this — local inference via Spark Control would be the path.
 
 ## Current state
 
-**Scaffolded + initial bot built 2026-06-28.** First milestone: invite the bot to a room named
-`<repo>` → it auto-joins, maps to `grant/<repo>`, and within ~60s of a new PR posts a threaded
-`claude -p` review; `merge` + `yes` in that thread merges it on Gitea and redacts the thread. Core
-flow ported from matrix-bridge (D15–D19), generalized to multi-repo + the subagent panel.
-**Not yet run** — needs the bot's `.env` (Matrix creds + `GITEA_TOKEN`) + `config.toml` on the
-Spark, then `docker compose up -d --build`; then onboard the first repo and validate the panel +
-in-chat agent toggles. A Spark Control tile is captured in the cross-project inbox.
+**Built + DEPLOYED 2026-06-28; awaiting first real PR.** Bot is running on the Spark (`docker compose
+up -d`), `@reviewer` is in a review room, the room is mapped to a repo, and the subagent panel is
+configured in-chat. Core flow ported from matrix-bridge (D15–D19), generalized to multi-repo + the
+panel. **Not yet exercised on a live PR** — next session: open a test PR and confirm the chain
+(threaded review → `merge`+`yes` → force_merge → auto-publish → thread redacted). **The one unproven
+bit:** headless `claude -p` spawning the reviewer/adjudicator/security subagents (Option B) — if it's
+flaky, fall back to bot-orchestrated separate `claude -p` runs (the rejected alternative; see ROADMAP
+Phase 2). **Deploy gotchas hit this session:** the Spark needs a *dedicated* per-repo Gitea deploy
+key + a `Host` alias (the default `immense-voyage.local` block uses matrix-bridge's key) — clone via
+the alias; Gitea won't reuse one SSH key across repos' deploy keys. A Spark Control tile is captured
+in the inbox.