Trigger agent upgrades from control plane

[arjunkomath]

Summary

• add control-plane actions and durable server state for agent upgrades
• deliver upgrades through the existing agent work queue with checksum-pinned payloads
• add agent self-upgrade handling with rollback marker, idempotent re-lease behavior, and systemd restart via exit
• mark upgrade success from heartbeats and fail timed-out upgrade attempts

Verification

• go test ./... (agent)
• pnpm exec tsc --noEmit (web)
• pnpm test (web)
• smart review pass: safe to PR

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit 749c559.}