feat(host_agent): a host says what updates it has waiting and whether it needs a reboot (#5765)

Step 1 of milestone 514 "Updates and reboots on a cadence, carried out by
each host's agent…": #5765 "The agent reports pending updates and whether
a reboot is required".

- Agent 1.16.0: an hourly background check (apt-check, apt list, or dnf -C
  with updateinfo and needs-restarting), each command bounded at 120 s, no
  root and no network. Debian's reboot-required marker and its packages
  are read every sample.
- Ingest records updates_pending, updates_security and reboot_required for
  rules, and keeps the newest on the registration (host_agent_005_updates).
- The Agent card leads with "Reboot required since …", then the updates
  waiting or "Up to date", with when the check ran. list_agents carries
  them too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/host_agent/__init__.py

@@ -67,11 +67,15 @@ def get_alert_metrics() -> dict[str, list[str]]:
     mounts_stalled counts the mounts that didn't answer the agent in time
     (agent ≥ 1.14.0): "an NFS share stopped" is > 0. agent_rss_bytes and
     agent_cpu_pct are the agent's own memory and CPU (agent ≥ 1.15.0): a
-    healthy agent sits in tens of MB and a few %."""
+    healthy agent sits in tens of MB and a few %. updates_pending and
+    updates_security are what the package manager has waiting, and
+    reboot_required is 1 when the host needs a reboot (agent ≥ 1.16.0):
+    "security updates waiting" is updates_security > 0."""
     return {"host_agent": [
         "cpu_pct", "mem_used_pct", "mem_available_bytes", "swap_used_bytes",
         "disk_used_pct_worst", "disk_used_pct", "inodes_used_pct", "load_1m", "load_5m", "load_15m",
         "load_pct",
         "uptime_secs", "seconds_since_seen", "clock_off_secs", "mounts_stalled",
         "agent_rss_bytes", "agent_cpu_pct",
+        "updates_pending", "updates_security", "reboot_required",
     ]}