fix(host_agent): every Docker read is bounded, and the agent reports its own footprint (#5764)

#5764 "The agent reads a container's whole log backlog into memory, on its
main loop, with no overall deadline". Docker03's 1.13.0 agent went silent
for a day at 2.1 GB and 46 h of CPU, then ignored SIGTERM.

- One shared reader, _docker_get: each answer has an overall deadline and a
  byte cap, not only a per-recv timeout. A trickling or endless body is cut
  off (15 s / 32 MiB for JSON, 5 s / 4 MiB for a log read).
- Container logs: since the cursor but only the newest 2,000 lines, all
  within 10 s. A note says when older lines were skipped, and a container
  whose answer is too big skips ahead to now instead of re-reading its
  backlog every interval.
- The agent reports its own RSS and CPU; Steward records agent_rss_bytes
  and agent_cpu_pct, so a runaway agent shows before it goes silent.

Agent 1.15.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/plugins/host_agent/test_expand_metrics.py

@@ -113,3 +113,12 @@ def test_a_wired_board_input_still_counts():
     assert counts_as_hottest("SYSTIN", 38.0) and counts_as_hottest("AUXTIN1", 60.0)
     assert not counts_as_hottest("SYSTIN", 114.0) and not counts_as_hottest("PCH_CHIP_TEMP", 0.0)
     assert counts_as_hottest("Package id 0", 101.0)     # a CPU past 100 is a hot CPU
+
+
+def test_the_agent_s_own_footprint_is_recorded():
+    """#5764: a runaway agent shows on the record before it goes silent."""
+    sample = {"ts": "2026-10-14T22:00:00+00:00",
+              "agent": {"rss_bytes": 18_000_000, "cpu_pct": 1.5}}
+    idx = _index(_expand_sample_to_metrics(sample, "d3", datetime.now(timezone.utc)))
+    assert idx[("agent_rss_bytes", "d3")] == 18_000_000
+    assert idx[("agent_cpu_pct", "d3")] == 1.5