feat(host_agent): a host says what updates it has waiting and whether it needs a reboot (#5765)

Step 1 of milestone 514 "Updates and reboots on a cadence, carried out by
each host's agent…": #5765 "The agent reports pending updates and whether
a reboot is required".

- Agent 1.16.0: an hourly background check (apt-check, apt list, or dnf -C
  with updateinfo and needs-restarting), each command bounded at 120 s, no
  root and no network. Debian's reboot-required marker and its packages
  are read every sample.
- Ingest records updates_pending, updates_security and reboot_required for
  rules, and keeps the newest on the registration (host_agent_005_updates).
- The Agent card leads with "Reboot required since …", then the updates
  waiting or "Up to date", with when the check ran. list_agents carries
  them too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/host_agent/models.py

@@ -2,7 +2,7 @@
 from __future__ import annotations
 import uuid
 from datetime import datetime, timezone
-from sqlalchemy import Column, String, DateTime, Float, ForeignKey
+from sqlalchemy import Boolean, Column, String, DateTime, Float, ForeignKey, Integer, Text
 from steward.models.base import Base
 
 
@@ -34,6 +34,19 @@ class HostAgentRegistration(Base):
     # and when that was. None until an agent that stamps its posts reports.
     clock_offset_s = Column(Float, nullable=True)
     clock_checked_at = Column(DateTime(timezone=True), nullable=True)
+    # What the package manager has waiting, from the agent's hourly check
+    # (agent ≥ 1.16.0, #5765). updates_security is None when the manager
+    # can't say; updates_error is why the last check failed.
+    updates_manager = Column(String(8), nullable=True)
+    updates_pending = Column(Integer, nullable=True)
+    updates_security = Column(Integer, nullable=True)
+    updates_checked_at = Column(DateTime(timezone=True), nullable=True)
+    updates_error = Column(String(200), nullable=True)
+    # Whether the host needs a reboot (None: it can't say), since when, and
+    # the packages that asked for it, comma-separated.
+    reboot_required = Column(Boolean, nullable=True)
+    reboot_required_since = Column(DateTime(timezone=True), nullable=True)
+    reboot_packages = Column(Text, nullable=True)
     created_at = Column(DateTime(timezone=True), nullable=False, default=_utcnow)
     updated_at = Column(DateTime(timezone=True), nullable=False,
                         default=_utcnow, onupdate=_utcnow)