Harden production workflows and agent admission

deploy/README.md

@@ -41,9 +41,9 @@ Boots the stack, hits `/health`, `/ready`, `/metrics`, ingests example payloads
 
 Full-fat demo stack with several dockerized agents driving the system through
 every witness state: agent alive/stale/dead, check ok/warning/critical/unknown,
-incident open/resolved, outbox sent/retry/failed/discarded,
+incident open/resolved, outbox sent/retry/failed,
 anti-double-alerting with `notifications_enabled=false`, and agent spool
-replay against a server that becomes available after the agent starts.
+replay after a controlled server outage.
 
 ```sh
 bash deploy/e2e-showcase.sh
@@ -52,7 +52,7 @@ bash deploy/e2e-showcase.sh
 Internally:
 
 ```sh
-MONLET_AUTH_TOKEN=monlet-dev-token docker compose -f deploy/docker-compose.yml -f deploy/docker-compose.showcase.yml up -d --build
+MONLET_AUTH_TOKEN=monlet-ui-dev-token docker compose -f deploy/docker-compose.yml -f deploy/docker-compose.showcase.yml up -d --build
 ```
 
 `SHOWCASE_KEEP=1 bash deploy/e2e-showcase.sh` leaves the stack up so you can
@@ -71,7 +71,7 @@ for demo/e2e only — production deploys the Go binary under systemd.
 - `smoke.sh` — local stack smoke entry point.
 - `docker-compose.showcase.yml` — override that adds demo agents + mock webhook.
 - `docker/agent.Dockerfile` — demo/e2e agent image (not for production).
-- `showcase/` — demo agent configs, check scripts, mock webhook, seed SQL.
+- `showcase/` — demo agent configs, check scripts, and mock webhook.
 - `e2e-showcase.sh` — full showcase runner (Stage 6.1).
 
 Docker images install Python/Node project dependencies inside the image; host venvs are never mounted (see `AGENTS.md`).