feat(agent): hierarchical executor with path resolve, runtime probe, quiet UI

Make Zed Agent closer to Cursor: deterministic DevOps path index, live Traefik
port probe before blind edits, stop-after-edit, and quieter Russian progress.

scripts/refresh-vless-subscription.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Refresh vless.conf from subscription and reload vless-proxy on Swarm (IFT).
+set -euo pipefail
+
+STACK_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+STACK_NAME="${STACK_NAME:-ai-router}"
+cd "$STACK_DIR"
+
+set -a
+# shellcheck disable=SC1091
+source .env
+set +a
+
+bash "${STACK_DIR}/scripts/fetch-vless-subscription.sh" "${STACK_DIR}/vless/vless.conf"
+
+CONF="$(cat "${STACK_DIR}/vless/vless.conf")"
+SVC="${STACK_NAME}_vless-proxy"
+
+rotate_vless_secret() {
+  if docker secret inspect vless_conf >/dev/null 2>&1; then
+    echo "== Detach old vless_conf secret =="
+    docker service scale "${SVC}=0" >/dev/null || true
+    sleep 3
+    docker service update --secret-rm vless_conf "${SVC}" >/dev/null 2>&1 || true
+    sleep 2
+    docker secret rm vless_conf >/dev/null 2>&1 || true
+  fi
+  echo -n "$CONF" | docker secret create vless_conf -
+}
+
+if docker service inspect "${SVC}" >/dev/null 2>&1; then
+  rotate_vless_secret
+  docker service update \
+    --secret-add "source=vless_conf,target=/app/vless.conf,mode=0444" \
+    "${SVC}" >/dev/null
+  docker service update --force "${SVC}" >/dev/null
+  TARGET="${VPN_ENABLED:-false}"
+  if [[ "$TARGET" == "true" ]]; then
+    docker service scale "${SVC}=1" >/dev/null
+  fi
+  echo "refresh-vless: vless-proxy reloaded"
+else
+  rotate_vless_secret
+  echo "refresh-vless: secret vless_conf updated (service ${SVC} missing — run deploy.sh)"
+fi