feat(host_agent): a host says what updates it has waiting and whether it needs a reboot (#5765)

Step 1 of milestone 514 "Updates and reboots on a cadence, carried out by
each host's agent…": #5765 "The agent reports pending updates and whether
a reboot is required".

- Agent 1.16.0: an hourly background check (apt-check, apt list, or dnf -C
  with updateinfo and needs-restarting), each command bounded at 120 s, no
  root and no network. Debian's reboot-required marker and its packages
  are read every sample.
- Ingest records updates_pending, updates_security and reboot_required for
  rules, and keeps the newest on the registration (host_agent_005_updates).
- The Agent card leads with "Reboot required since …", then the updates
  waiting or "Up to date", with when the check ran. list_agents carries
  them too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/host_agent/templates/panel.html

@@ -19,6 +19,27 @@
      "Manage agent" (#5278). #}
   <a href="/plugins/host_agent/{{ host.id }}/" class="btn btn-sm btn-ghost">Full metrics →</a>
 
+  {# What the host has waiting, from the agent's hourly check (#5765): a
+     needed reboot first, then the updates. #}
+  {% if reg.updates_checked_at or reg.reboot_required %}
+  <div style="margin-top:0.8rem;font-size:0.82rem;display:flex;flex-direction:column;gap:0.2rem;">
+    {% if reg.reboot_required %}
+    <div class="tone-warn" title="{{ reg.reboot_packages or '' }}">
+      Reboot required{% if reg.reboot_required_since %} since {{ reg.reboot_required_since|ago }}{% endif %}{% if reg.reboot_packages %}
+      <span style="color:var(--text-muted);">· {{ reg.reboot_packages|truncate(80) }}</span>{% endif %}
+    </div>
+    {% endif %}
+    {% if reg.updates_checked_at %}
+    <div>
+      {% if reg.updates_error %}<span class="tone-warn">Update check failed: {{ reg.updates_error }}</span>
+      {% elif reg.updates_pending %}<span class="{{ 'tone-warn' if reg.updates_security else '' }}">{{ reg.updates_pending }} update{{ 's' if reg.updates_pending != 1 }} waiting{% if reg.updates_security %} ({{ reg.updates_security }} security){% endif %}</span>
+      {% else %}Up to date{% endif %}
+      <span style="color:var(--text-muted);">· checked {{ reg.updates_checked_at|ago }}</span>
+    </div>
+    {% endif %}
+  </div>
+  {% endif %}
+
   {# What the agent said happened while it was away, last 7 days (#5756). #}
   {% if downtime %}
   <div style="margin-top:0.8rem;">