fix(host_agent): the maintenance-jobs migration waits for maintenance_windows, and the guards know the new table and action (#5767)

CI 9146 on 22b0be2:
- integration: host_agent_007 ran before core 0010 created maintenance_windows
  (its window_id foreign key), so the schema never built. It now
  depends_on 0010_maintenance_windows.
- unit: host_maintenance_jobs is named in the backup's EXCLUDED (run
  history, like ansible_runs and host_downtime), and the
  host_agent.maintenance audit action has its wording.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/host_agent/migrations/versions/host_agent_007_maint_jobs.py

@@ -9,7 +9,8 @@ import sqlalchemy as sa
 revision: str = "host_agent_007_maint_jobs"
 down_revision: Union[str, None] = "host_agent_006_maint_helper"
 branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
+# maintenance_windows (core 0010) must exist before the window_id key.
+depends_on: Union[str, Sequence[str], None] = ("0010_maintenance_windows",)
 
 
 def upgrade() -> None:

steward/audit/service.py

@@ -137,6 +137,7 @@ ACTIONS = {
     "user.joined": "joined from an invite as",
     "host.created": "added host",
     "host.renamed": "renamed host",
+    "host_agent.maintenance": "started maintenance (update, reboot if needed) on host",
     "host.deleted": "deleted host",
     "monitor.created": "added monitor",
     "monitor.updated": "changed monitor",

steward/backup/contents.py

@@ -38,6 +38,8 @@ EXCLUDED: frozenset[str] = frozenset({
     "monitor_results",
     # A host's downtime as its agent reported it: history, like the metrics.
     "host_downtime",
+    # Maintenance jobs (#5767): run history, like ansible_runs.
+    "host_maintenance_jobs",
     "email_outbox", "email_outbox_events", "password_resets",
     # Run history; its logs live on disk, not in the database.
     "ansible_runs",