feat(host_agent): a root helper the agent can start, for updates, reboots and drains only (#5766)

#5766 "A root helper the agent can start, for a fixed set of maintenance
actions and nothing else", milestone 514.

The agent runs unprivileged under NoNewPrivileges, so it can't update or
reboot its host. It now leaves a request in /var/lib/steward-agent/requests,
the one path its unit lets it write; steward-maint.path starts maint.py as
root, which reads it without following links, accepts only update, reboot,
drain or undrain, deletes it, and writes the outcome to
/var/lib/steward-maint/results. The agent (1.17.0) reports each new result
state once as a `maintenance` event, re-checks pending updates when an update
finishes, and says in its metadata whether the helper is installed.

The units and the helper are served from one copy at
/plugins/host_agent/files/<name> (a fixed list), and install.sh plus the
install, provision and update playbooks all fetch them, replacing three
inline copies of the unit. Update agent installs the helper on existing
hosts; the Agent panel says under Manage agent whether it is there.

Steward handing out jobs is #5767; the cadence is #5768.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/core/test_host_page.py

@@ -260,3 +260,22 @@ async def test_the_agent_card_leads_with_a_needed_reboot_then_the_updates(app):
     assert page.index("Reboot required") < page.index("12 updates waiting (3 security)")
     assert "libc6" in page
     assert "Up to date" in quiet and "Reboot required" not in quiet
+
+
+async def test_manage_agent_says_whether_the_maintenance_helper_is_installed(app):
+    """#5766: the helper arrives with Update agent; until then the panel says so."""
+    from datetime import datetime, timezone
+    from tests._templates import render_plugin_template
+    host = SimpleNamespace(id="h1", name="box", address="10.0.0.5")
+    reg = SimpleNamespace(agent_version="1.17.0", last_seen_at=datetime.now(timezone.utc),
+                          maint_helper=True)
+    kw = dict(host=host, reporting=True, stale=False, target=None, ansible_available=False,
+              managed_key_set=False, downtime=[])
+    async with app.test_request_context("/plugins/host_agent/panel/h1"):
+        session["user_role"] = "admin"
+        installed = await render_plugin_template(app, "host_agent", "panel.html", reg=reg, **kw)
+        missing = await render_plugin_template(
+            app, "host_agent", "panel.html",
+            reg=SimpleNamespace(**{**vars(reg), "maint_helper": None}), **kw)
+    assert "Maintenance helper installed" in installed
+    assert "No maintenance helper yet: Update agent installs it" in missing