- wire FileWatchService into the Agent reload loop - track SSL cert paths per pipeline. When a cert changes, mark the pipeline stale and trigger a reload.