Refresh agent signing keys from repository (Refs #64)

docs/guides/getting-started.md

@@ -9,8 +9,8 @@ HTTPS. Running game containers continue through controller or agent outages.
 
 - A controller machine with Docker Compose and an HTTPS reverse proxy.
 - Debian 12 or 13 amd64 game hosts with storage for game files and instances.
-- A signed agent release, plus its publisher's public key and reviewed installer
-  obtained through a trusted channel independent of the controller.
+- A signed agent release and its public key published in the trusted repository.
+- Outbound HTTPS access from game hosts to the controller and public repository.
 - Your complete T5 or T6 game folders, including the DLC you intend to host.
 - Plutonium server keys for each game, with one unused key per new concurrent lobby.
 
@@ -69,14 +69,13 @@ password recovery.
 1. Open **Releases → Game files** and upload the complete local folder for T5 or
    T6, including DLC. Uploads can run before any host is enrolled. The latest
    verified upload becomes that game's default files.
-2. [Provision release trust](native-hosts.md#provision-release-trust): independently
-   verify the publisher key's full fingerprint, install its binary public key at
-   `/etc/electric-cherry/release-signing.gpg`, and copy the reviewed installer to
-   `./electric-cherry-install.sh` on the host. Both come from the trusted publisher.
+2. Ensure the release publisher has [published its public key and signed release](native-hosts.md#publishing-signed-releases).
+   Hosts fetch the key automatically during installation and before every update
+   check; there is no manual key-copy step.
 3. Open **Fleet → Hosts → Add Host**, configure the host's game-port range and
-   bind address, and run the generated enrollment command from the directory
-   containing that local installer. Do not pipe controller-downloaded code into
-   a root shell.
+   bind address, and run the generated enrollment command. It downloads the
+   installer from the fixed public repository URL before running it. Check that
+   the installer source is the known repository, independent of the controller.
 4. Wait for automatic setup to prepare the Plutainer runtime and available game
    files. The host page reports download, verification, and readiness progress.