Create Agent

Platform staff only. Publishes a NEW agent to the catalogue.

Until now a new agent was provisioned by a one-off script run on the box with the app's Mongo connection (scripts/seed_agent_code_analysis.py). This is that script as a route, with the guards the script could not have: the caller is identified, the write is audited, and a second create on the same id is refused instead of silently upserting over the first.

The moment this returns 201 the agent is DISTRIBUTABLE: the public catalogue lists it on the next read (edge cache: 300 s) and every paid client can fetch and install it. So the content is validated as an installable file — a frontmatter with the version: the update loop keys on and a name: equal to the served id — but it is stored VERBATIM, never re-serialised.