Move netx URL/token into DSH host settings and credentials.

Mount MCP from dsh-netxops instead of OS env in the agent preset.

scripts/set-netx-token.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set -euo pipefail
+TOKEN="${1:-}"
+if [[ -z "$TOKEN" ]]; then
+  echo "usage: $0 <NETX_API_TOKEN>" >&2
+  exit 1
+fi
+DSH_HOME="${DSH_HOME:-$HOME/.dsh}"
+mkdir -p "$DSH_HOME"
+PATH_FILE="$DSH_HOME/.credentials.yaml"
+ESC=${TOKEN//\'/\'\'}
+
+if [[ ! -f "$PATH_FILE" ]]; then
+  cat >"$PATH_FILE" <<EOF
+version: 1
+
+refs:
+  NETX_API_TOKEN: '$ESC'
+EOF
+  echo "Created $PATH_FILE with NETX_API_TOKEN"
+  exit 0
+fi
+
+if grep -qE '^[[:space:]]*NETX_API_TOKEN[[:space:]]*:' "$PATH_FILE"; then
+  # portable-ish in-place replace
+  tmp="$(mktemp)"
+  sed -E "s|^([[:space:]]*NETX_API_TOKEN[[:space:]]*:[[:space:]]*).*$|\1'$ESC'|" "$PATH_FILE" >"$tmp"
+  mv "$tmp" "$PATH_FILE"
+else
+  if grep -qE '^refs[[:space:]]*:' "$PATH_FILE"; then
+    tmp="$(mktemp)"
+    awk -v tok="$ESC" '
+      BEGIN{done=0}
+      /^refs[[:space:]]*:/ && !done { print; print "  NETX_API_TOKEN: '\''" tok "'\''"; done=1; next }
+      { print }
+    ' "$PATH_FILE" >"$tmp"
+    mv "$tmp" "$PATH_FILE"
+  else
+    printf '\nrefs:\n  NETX_API_TOKEN: '\''%s'\''\n' "$ESC" >>"$PATH_FILE"
+  fi
+fi
+echo "Updated NETX_API_TOKEN in $PATH_FILE"
+echo "If dsh is running, wait for credential reload or restart dsh web."