docs: Updated docs

docsite/docs/reference/agent-config.md

@@ -37,31 +37,9 @@ tls: true
 
 :::danger This file is the credential
 `agent_token` is plaintext here and nowhere else the control plane holds only
-its SHA-256. Anyone who can read this file can act as this agent. That is why
-it is `0600` and the directory is `0700`.
+its SHA-256. Anyone who can read this file can act as this agent.
 :::
 
-## Startup sequence
-
-```
-1. Load the config
-2. pre_reg_token present → register → save agent_token,
-   clear pre_reg_token, reconnect
-3. Start: command stream · hourly update check · inventory · monitors
-4. Enter the key poll loop
-```
-
-## The poll loop
-
-```
-1. Ask the control plane for the desired key state, reporting the
-   agent version
-2. Non-Linux hosts stop here Windows agents register and heartbeat only
-3. Diff the desired keys against /root/.ssh/authorized_keys;
-   unchanged → write nothing
-4. Changed → write a temp file, rename it over the real one, chmod 0600
-```
-
 ## Service management
 
 ### Linux
@@ -77,21 +55,13 @@ journalctl -u vantage-agent -f
 
 ### Windows
 
-A service registered through NSSM, or installed by the MSI that CI builds.
+A service registered through NSSM, or installed by the MSI.
 
 ```powershell
 Get-Service vantage-agent
 Restart-Service vantage-agent
 ```
 
-## Command-line flags
-
-```
-vantage-agent -generate-key
-```
-
-Generates a keypair locally. Normal operation takes no flags.
-
 ## Moving an agent to a new control plane
 
 Change `server_url`, clear `agent_token`, set a fresh `pre_reg_token` from a new