Document publish.sh make-install deploy step (now step 5)

AGENTS.md

@@ -114,10 +114,11 @@ Operator-specific memories at `~/.claude/projects/-Users-macpro-Projects-keysat/
   publish **`0.2.0:57`** — universal multi-arch (x86_64 + aarch64), GitHub release
   `v0.2.0-57`. Migrations 0020–0023; four SDKs published; `keysat.xyz` +
   `docs.keysat.xyz` deployed.
-- **Live server `immense-voyage.local` still runs `:56`** — `:57` was published to the
-  registry this session but NOT `make install`-deployed to the box (`publish.sh` doesn't
-  touch the live host). Run `make install` from `licensing-service-startos/` to put the
-  new role on the live server when ready.
+- **Live server `immense-voyage.local` still runs `:56`** — `:57` shipped to the registry
+  this session, but the box wasn't redeployed (that publish run predated this session's
+  change adding `make install` as `publish.sh` step 5). Run `make install` from
+  `licensing-service-startos/` once to catch the box up to `:57`; future `publish.sh` runs
+  now deploy to the live host automatically (best-effort, non-fatal).
 - **Shipped this session as `:57`** (feature `d5885d1`, bump `069cf1e`; pushed
   origin+gitea) — **`merchant-onboard` scoped-key role** for least-privilege self-serve
   onboarding: read + `products:write` + `policies:write` + `licenses:write` (create

docs/guides/startos-packaging.md

@@ -38,7 +38,7 @@ silently no-ops an install whose version equals what's already installed. Run
 ## Release (operator-local scripts, in `~/.keysat/`, gitignored)
 
 ```
-~/.keysat/publish.sh                       # version-gate → make universal → FileBrowser upload → registry register → GitHub mirror
+~/.keysat/publish.sh                       # version-gate → make universal → FileBrowser upload → registry register → GitHub mirror → make install (deploy to live host, best-effort)
 ~/.keysat/deploy-sites.sh landing docs     # push static sites; accepts: landing | docs | registry-landing
 ```