Safe restart on github-oauth plugin install

Since we're running chef every thirty minutes,
a forced restart could interrupt running jobs.
UNTESTED WIP: refactor to hide platforms from user
gitignore
misc
inline publishing config
fix worker environment computation

cannot ship closures, so encode them as strings
public label for jenkins home without secrets