One fix, no new command and no change to the piped output of the parity cases.

Fixed

• Both kubehz agents run on a control-plane-only cluster. The live agent's Deployment and the heartbeat CronJob tolerate the control-plane taint (node-role.kubernetes.io/control-plane and the legacy master key, NoSchedule). Before, both pods stayed Pending on a cluster with one server and no worker, and on any cluster whose workers join after lo kubehz deploy. The deploy then reported "the live agent was accepted but never became Ready", the CronJob never ran, and the cluster reported nothing to the platform. With workers present the live agent prefers one of them (#228). The Deployment is the vendored copy of kubehz-agent's deploy/base, which carries the same change.

Changed

• The deploy's Ready-timeout message, in both implementations, names an untolerated node taint beside an unpullable image as the usual cause. The CLI reference says a Pending agent points at scheduling, not at the wait. The kubehz guide says both agents run on a control-plane-only cluster.
• The live agent runs with strategy: Recreate: an existing cluster sees one pod restart and a short heartbeat gap at its next lo kubehz deploy, and the pod can move to a worker.

Upgrade

Nothing to do. An existing cluster gets the tolerations at its next lo kubehz deploy.