update

agent/app/core/installer.py

@@ -128,8 +128,8 @@ class AptInstaller(DebInstaller):
     def discover_service_units(self, package_name: str) -> list[str]:
         """Return concrete systemd service units shipped by an installed package.
 
-        The package name is already constrained by the Agent APT allowlist.  It is
-        still passed as a single argv item and no shell expansion is performed.
+        The package name is already syntax-validated by the manifest validator. It
+        is passed as a single argv item and no shell expansion is performed.
         Template units are omitted because they cannot be meaningfully checked
         without an instance name.
         """