Workers screen shows each agent's version and protocol, and who is behind

The hello carries the fluksio-worker version. An agent refused for an older
protocol stays listed as Needs upgrade until it attaches again. Docs gain an
Upgrading workers section.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WgBfkm4rCmtd1T4vHWjEPx

docs/code/workers.md

@@ -127,7 +127,7 @@ curl "$API_URL/workers" -H "Authorization: Bearer $TOKEN"
 curl "$API_URL/workers/resources" -H "Authorization: Bearer $TOKEN"
 ```
 
-## Revoke or upgrade
+## Revoke a token
 
 List tokens and revoke one by its `jti`:
 
@@ -138,12 +138,19 @@ curl -X POST "$API_URL/workers/tokens/$JTI/revoke" \
 ```
 
 Revocation also disconnects attached workers and blocks artifact access.
-Replacing the OAuth signing key revokes all worker tokens.
+Replacing the OAuth signing key revokes all worker tokens. Older tokens without
+signed labels and a `jti` need to be replaced.
 
-Upgrade the engine before its workers, then run `pip install -U fluksio-worker`
-on each host. Engine and worker must speak the same protocol; a mismatch is
-reported and refused. Older tokens without signed labels and a `jti` need to
-be replaced.
+## Upgrading workers
+
+Engine and worker must speak the same protocol. A worker on another protocol is
+refused and exits, so a release that bumps the protocol needs
+`pip install -U fluksio-worker` on every worker host. Upgrade the engine first,
+then the workers.
+
+The **Workers** screen shows each worker's package version and protocol. A
+worker refused for an older protocol stays listed as **Needs upgrade** until it
+attaches again, or until the engine restarts.
 
 ## Slurm provisioning