Deploy the ssh extra, from one place

update.sh installed `[search]` only, so the release that added agent
connections shipped without asyncssh and the feature offered an install
hint on a machine that had just been told to install it.

The extras are now one variable, spelled the same way in install.sh and
update.sh, with a comment in both saying they have to stay in step. That is
the whole failure mode: an extra added to one of them is an extra existing
deployments silently miss.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

deploy/install.sh

@@ -76,9 +76,13 @@ if [[ ! -x "$VENV/bin/python" ]]; then
   sudo -u "$SERVICE_USER" python -m venv "$VENV"
 fi
 sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet --upgrade pip
-# With the `search` extra: DuckDuckGo is the default web search provider and is
-# meant to work with no setup at all.
-sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet -e "$APP[search]"
+# The extras a deployment gets. `search` because DuckDuckGo is the default web
+# search provider and is meant to need no setup; `ssh` because agent chats reach
+# their machine over it and a deployment without it offers the feature with an
+# install hint instead. Listed here AND in update.sh -- an extra added to only
+# one of them means existing deployments silently miss it.
+LEMBAS_EXTRAS="${LEMBAS_EXTRAS:-search,ssh}"
+sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet -e "$APP[$LEMBAS_EXTRAS]"
 
 echo "== environment =="
 # Generated once and never regenerated: rotating LEMBAS_SECRET_KEY signs every