chore(pm-agent): turn PM_DRY_RUN off (operator-approved), bump config-generation to 4

The run-383 worker image (df36d9b, pinned in #96) bakes imagePullSecrets: pm-agent-registry,
which admission requires, and the dispatcher's dry-run triage of #97 was read and approved.
PM_REQUIRE_LABEL=agent and the worker caps are unchanged. The dry-run status text in the
configmap comments, the README and the plan's follow-up 3 is updated to match.

Pre-flight (read-only, k3s-prod): pm-agent-job-shape Ready+Enforce; SA/Role/RoleBinding
present and can-i create jobs = yes; pm-agent-registry and pm-agent-credentials exist; both
egress CNPs Valid.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/pm-agent/configmap.yaml

@@ -58,11 +58,11 @@ data:
   # request that also moves the Deployment's image (same marker, same branch). Nobody pushes
   # this image from a workstation.
   #
-  # READ BEFORE TURNING PM_DRY_RUN OFF: this digest PREDATES the worker template's
-  # `imagePullSecrets` entry (PR #61). Its baked template has none, and admission now REQUIRES
-  # it — so a worker Job built from this image is DENIED. The merge that adds the entry
-  # changes infra/agent/**, CI re-publishes agent-runner, and Renovate's bump to that digest
-  # is what makes worker Jobs admissible. Until then, dry run is the only mode that works.
+  # The run-340 digest predated the worker template's `imagePullSecrets` entry (PR #61), which
+  # admission REQUIRES, so its worker Jobs were DENIED. The digest below (df36d9b, run 383,
+  # agent-runner:sha-ddd04d460ef6, pinned in PR #96) bakes a template that carries
+  # `imagePullSecrets: pm-agent-registry`, which is what made turning PM_DRY_RUN off possible
+  # (decisions/2026-10-31-pm-agent-runner-digest.md). A digest older than that would be DENIED.
   # renovate-digest: image=gitea.home.keithjackson.dev/home-network/agent-runner tag=main
   PM_WORKER_IMAGE: "gitea.home.keithjackson.dev/home-network/agent-runner@sha256:df36d9b7fef56d141220a387f64fb864cede8e5af30513ebfeb3ab566d3f771d"
 
@@ -120,10 +120,11 @@ data:
   # no worker Job and so changes no code. The honest way to watch this service for a day
   # before letting it write anything.
   #
-  # "true" FOR THE FIRST RUN, and not only for caution: the pinned digest above cannot yet
-  # create an admissible worker Job (see the PM_WORKER_IMAGE comment). Flip to "false" in the
-  # same pull request as — or after — Renovate's first agent-runner digest bump.
-  PM_DRY_RUN: "true"
+  # "true" for the first run (2026-10-30 .. 2026-10-31); dry-run triage of issue #97 was read
+  # and the operator approved going live. "false" since decisions/2026-10-31-pm-agent-go-live.md.
+  # Setting it back to "true" (plus a config-generation bump) is the gentlest stop — see
+  # runbooks/pm-agent.md.
+  PM_DRY_RUN: "false"
 
   # If the gate refuses a worker's change, the branch is NOT pushed by default and the issue
   # gets the gate log instead. Set to "true" to push anyway and open a red pull request —