feat(host-agent): updates on pacman, zypper and yum hosts (#5803, #5804)

Agent 1.21.0. The hourly update check now covers the package managers
beyond apt and dnf (#5803 "The agent's update check reads pacman,
zypper and yum"):
- yum: `yum -C check-update`, `updateinfo list security`,
  `needs-restarting -r`, as dnf.
- zypper: `--no-refresh list-updates` (`--dup` on Tumbleweed),
  needed security patches from `list-patches --category security`,
  and `zypper needs-rebooting`.
- pacman: `checkupdates` from pacman-contrib, which install-deps.sh now
  installs. pacman has no security notion; a reboot is required once
  the running kernel's /usr/lib/modules/<release> is gone.
The checks sit in one UPDATE_CHECKS table, and a failure names its
manager.

The root helper's update runs on the same hosts (#5804 "The scheduled
update runs on pacman, zypper and yum hosts"): yum upgrade, zypper
refresh + update (dup on Tumbleweed, with 102/103 counted as success),
pacman -Syu. Each step carries a label so a failure says which one,
and the reboot check reads zypper and the pacman kernel too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/host_agent/files/install-deps.sh

@@ -5,13 +5,14 @@
 # and the host_agent playbooks: one copy of the list.
 #
 # smartmontools gives the helper smartctl, which reads each drive's health.
+# On pacman hosts, pacman-contrib gives the agent checkupdates, the one safe
+# way to see pending updates without root (#5803).
 # A package that can't be installed is reported, never fatal: the agent runs
 # without it and the host page says what is missing.
 #
 # Recommended / weak dependencies are skipped: on Debian, smartmontools
 # recommends a mail server.
 
-PACKAGES="smartmontools"
 
 have() { command -v "$1" >/dev/null 2>&1; }
 
@@ -39,12 +40,15 @@ install_with() {
 
 missing=""
 have smartctl || missing="$missing smartmontools"
-[ -n "$missing" ] || { echo "dependencies present: $PACKAGES"; exit 0; }
+if have pacman && ! have checkupdates; then
+    missing="$missing pacman-contrib"
+fi
+[ -n "$missing" ] || { echo "dependencies present"; exit 0; }
 
 # shellcheck disable=SC2086  # one word per package
 if install_with $missing; then
     echo "installed:$missing"
 else
-    echo "WARNING: could not install$missing; drive health will read \"smartctl not installed\" until it is"
+    echo "WARNING: could not install$missing; until it is, drive health reads \"smartctl not installed\" (smartmontools) and the update check reads \"checkupdates isn't installed\" (pacman-contrib)"
 fi
 exit 0