docs: MEMPALACE_PI_DEVICE now also attributes drawers

Follow-up to c64ffa1, which changed the --agent default but left --help
claiming $USER. Fixes that text and states in README/ARCHITECTURE that the
device label reaches the palace as added_by, since mempalace stores neither the
machine nor the harness on a write.

README.md

@@ -573,8 +573,10 @@ exports. `--mode remote` (or `--mode auto`, which detects
 the palace host and asks the server to mine its own local copy. Requires
 `$MEMPALACE_PI_SSH_TARGET` (`user@host:path`); see `MEMPALACE_PI_SSH_CONFIG`,
 `MEMPALACE_PI_REMOTE_PATH`, and `MEMPALACE_PI_DEVICE` in `--help` for the
-rest. Deploying that primary — newt, DNS, and why the auth is a shared bearer
-token rather than per-device proxy users — is
+rest. `MEMPALACE_PI_DEVICE` also defaults `--agent` to `pi@<device>` so each
+drawer's `added_by` records which harness and which machine produced it —
+mempalace itself stores neither. Deploying that primary — newt, DNS, and why the
+auth is a shared bearer token rather than per-device proxy users — is
 [`docs/phase-1-exposure-runbook.md`](docs/phase-1-exposure-runbook.md).
 
 ---