feat(host_agent): a host says what updates it has waiting and whether it needs a reboot (#5765)

Step 1 of milestone 514 "Updates and reboots on a cadence, carried out by
each host's agent…": #5765 "The agent reports pending updates and whether
a reboot is required".

- Agent 1.16.0: an hourly background check (apt-check, apt list, or dnf -C
  with updateinfo and needs-restarting), each command bounded at 120 s, no
  root and no network. Debian's reboot-required marker and its packages
  are read every sample.
- Ingest records updates_pending, updates_security and reboot_required for
  rules, and keeps the newest on the registration (host_agent_005_updates).
- The Agent card leads with "Reboot required since …", then the updates
  waiting or "Up to date", with when the check ran. list_agents carries
  them too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/core/formatting.py

@@ -342,6 +342,9 @@ METRICS: dict[str, tuple[str, str]] = {
     "mounts_stalled": ("Mounts not answering", "mounts the agent couldn't read in 5 s, e.g. an NFS share whose server stopped"),
     "agent_rss_bytes": ("Agent memory", "the host agent's own resident memory; tens of MB is normal"),
     "agent_cpu_pct": ("Agent CPU", "the host agent's own CPU, % of one core; a few % is normal"),
+    "updates_pending": ("Updates waiting", "packages the host's package manager would upgrade, checked hourly"),
+    "updates_security": ("Security updates waiting", "of the updates waiting, those from a security source"),
+    "reboot_required": ("Reboot required", "1 when the host needs a reboot to finish an update, 0 when not"),
 }
 
 # Where a rule's metric comes from, as the picker and the rules list say it.