Remote runtimes (agents)

Add a runtime with Through an agent: BeziSync shows a one-time install command (closing it needs "I've copied it", since the token is never shown again; Helm chart deploy/helm/bezisync-agent, or docker run of the bezisync image). The agent runs next to the runtime and only makes outbound HTTPS requests to BeziSync — no inbound firewall rules and no runtime credentials in BeziSync. If the agent disconnects for 30 seconds, its pipelines show Unknown (never Healthy) with the reason. "New agent token" (More actions) rotates the token; the old one stops working immediately.