changed to incubator

added new install script
updated security
updated ETA

README.md

@@ -23,6 +23,15 @@ Set `API_TOKEN` in `agent/.env`; the management server uses that token when call
 
 The agent persists recent jobs in SQLite through `AGENT_DATABASE_PATH` (default: `./agent.sqlite`). If the agent restarts while a job is `queued` or `running`, that job is marked `failed` on startup so management can poll a final state and stale VM locks are not kept.
 
+The installer clones only the agent-related repository paths and installs `incubator` for updates and diagnostics:
+
+```bash
+sudo incubator update
+sudo incubator status
+sudo incubator logs
+sudo incubator doctor
+```
+
 The agent can serve HTTPS directly for private networks:
 
 ```env