fix(worker): deploy persistent runtime companions

deploy/telemetry-plane/README.md

@@ -136,13 +136,18 @@ change inference control flow.
 
 When the mounted perception runner itself changes, use
 `Update-NdcMissionCorePerceptionRunner.ps1` with exact predecessor and candidate
-digests for both the runner and its standalone telemetry module. It backs up the
-mounted files, restarts the same container, accepts only a ready health document with
-stage metrics and a ready native journal transport, and restores the predecessor on
-failure. Update the token-stdin launcher separately with
-`Update-NdcMissionCorePersistentLauncher.ps1`; this keeps the operational
-contour/agent/node identity explicit and reviewable without changing the K1 command
-sequence.
+digests for the runner, its `e15_shadow_runtime.py` companion and its standalone
+telemetry module. The three files form one deployment unit: updating the runner
+without the matching runtime is rejected by the digest-gated transaction. It backs
+up the mounted files, restarts the same container, accepts only a ready health
+document with stage metrics and a ready native journal transport, and restores the
+predecessor set on failure. Update the token-stdin launcher separately with
+`Update-NdcMissionCorePersistentLauncher.ps1`. The launcher update always installs
+and digest-checks `MissionCoreDockerNames.ps1` in the same transaction because the
+launcher dot-sources that companion contract before any worker request. Both files
+are restored (or a previously absent companion is removed) if validation fails. This
+keeps the operational contour/agent/node identity explicit and reviewable without
+changing the K1 command sequence.
 
 The stack and agent are intentionally not started by repository tests. Provisioning a
 machine is a separate, explicit operation.