feat(host_agent): a root helper the agent can start, for updates, reboots and drains only (#5766)

#5766 "A root helper the agent can start, for a fixed set of maintenance
actions and nothing else", milestone 514.

The agent runs unprivileged under NoNewPrivileges, so it can't update or
reboot its host. It now leaves a request in /var/lib/steward-agent/requests,
the one path its unit lets it write; steward-maint.path starts maint.py as
root, which reads it without following links, accepts only update, reboot,
drain or undrain, deletes it, and writes the outcome to
/var/lib/steward-maint/results. The agent (1.17.0) reports each new result
state once as a `maintenance` event, re-checks pending updates when an update
finishes, and says in its metadata whether the helper is installed.

The units and the helper are served from one copy at
/plugins/host_agent/files/<name> (a fixed list), and install.sh plus the
install, provision and update playbooks all fetch them, replacing three
inline copies of the unit. Update agent installs the helper on existing
hosts; the Agent panel says under Manage agent whether it is there.

Steward handing out jobs is #5767; the cadence is #5768.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/host_agent/files/steward-agent.service

@@ -0,0 +1,26 @@
+# Served by Steward at /plugins/host_agent/files/steward-agent.service and
+# installed by install.sh and the host_agent playbooks: one copy of the unit.
+[Unit]
+Description=Steward host agent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=steward-agent
+Environment=STEWARD_AGENT_CONFIG=/etc/steward-agent.conf
+ExecStart=/usr/bin/env python3 /usr/local/lib/steward-agent/agent.py
+Restart=on-failure
+RestartSec=5
+# Stopping waits for the agent's last post, bounded at 10 s.
+TimeoutStopSec=30
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+ReadOnlyPaths=/proc /sys
+# The one place the agent writes: requests to the maintenance helper (#5766).
+ReadWritePaths=-/var/lib/steward-agent/requests
+
+[Install]
+WantedBy=multi-user.target