feat(host_agent): a host says what updates it has waiting and whether it needs a reboot (#5765)

Step 1 of milestone 514 "Updates and reboots on a cadence, carried out by
each host's agent…": #5765 "The agent reports pending updates and whether
a reboot is required".

- Agent 1.16.0: an hourly background check (apt-check, apt list, or dnf -C
  with updateinfo and needs-restarting), each command bounded at 120 s, no
  root and no network. Debian's reboot-required marker and its packages
  are read every sample.
- Ingest records updates_pending, updates_security and reboot_required for
  rules, and keeps the newest on the registration (host_agent_005_updates).
- The Agent card leads with "Reboot required since …", then the updates
  waiting or "Up to date", with when the check ran. list_agents carries
  them too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/host_agent/migrations/versions/host_agent_005_updates.py

@@ -0,0 +1,34 @@
+# plugins/host_agent/migrations/versions/host_agent_005_updates.py
+"""host_agent: a host's pending updates and whether it needs a reboot (#5765)
+
+Revision ID: host_agent_005_updates
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "host_agent_005_updates"
+down_revision: Union[str, None] = "host_agent_004_downtime"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+_COLUMNS = (
+    ("updates_manager", sa.String(8)),
+    ("updates_pending", sa.Integer()),
+    ("updates_security", sa.Integer()),
+    ("updates_checked_at", sa.DateTime(timezone=True)),
+    ("updates_error", sa.String(200)),
+    ("reboot_required", sa.Boolean()),
+    ("reboot_required_since", sa.DateTime(timezone=True)),
+    ("reboot_packages", sa.Text()),
+)
+
+
+def upgrade() -> None:
+    for name, kind in _COLUMNS:
+        op.add_column("host_agent_registrations", sa.Column(name, kind, nullable=True))
+
+
+def downgrade() -> None:
+    for name, _kind in reversed(_COLUMNS):
+        op.drop_column("host_agent_registrations", name)