Add agent restart lifecycle command

Extends the existing CheckIn RPC with a one-shot AgentCommand
(restart only -- stop/uninstall need real per-platform OS
service-manager integration and stay deliberately out of scope),
delivered at-most-once: cleared the instant it's handed to the agent
in a response, since a restarting agent's process is gone before it
could ever confirm receipt. On restart, the agent flushes whatever's
buffered, aborts its source task, and exits cleanly, relying entirely
on the host's own service manager to bring it back up.

Issuing a command is gated at RoleAdmin (stricter than config
editing's RoleEditor) and logged into the same audit_log table Phase
7's AI interactions use, via a new agent_command event type.

A real bug was found and fixed during live verification: the first
implementation tried to atomically read-and-clear pending_command in
a single INSERT...ON CONFLICT statement using a sibling CTE
referenced only from RETURNING, on the assumption that Postgres
evaluates every part of a WITH query against one pre-statement
snapshot. That's wrong specifically for FOR UPDATE, which always
reads the latest row version including one written earlier in the
same statement -- confirmed empirically (a restart command was
always coming back empty even when genuinely pending, so the agent
never received it). Fixed by splitting into two real, ordered
statements inside one explicit transaction.

See /docs/agent-management-design.md's "Lifecycle commands" section.

ingest/internal/grpcserver/server.go

@@ -91,9 +91,32 @@ type TenantResolver interface {
 // simply doesn't get agent inventory/management, exactly like one
 // without ENTERPRISE_AUTH_URL doesn't get tenant-tagged records.
 type AgentRegistry interface {
-	CheckIn(ctx context.Context, tenantID string, info AgentCheckIn) (AgentOverride, error)
+	CheckIn(ctx context.Context, tenantID string, info AgentCheckIn) (CheckInResult, error)
 }
 
+// CheckInResult bundles the two independent things a CheckIn can hand
+// back to an agent -- a persistent config override to converge to, and
+// a one-shot command to act on immediately. Kept as two separate
+// concepts (not folded into one "override" shape) since their delivery
+// semantics differ: Override is re-offered every CheckIn until the
+// agent's applied_override_version matches; Command is cleared the
+// instant it's handed out (see agent_control.proto's CheckInResponse
+// comment).
+type CheckInResult struct {
+	Override AgentOverride
+	// Command is AgentCommandRestart or "" (nothing pending). A plain
+	// string, not the generated proto enum type, so AgentRegistry
+	// implementations don't need to import the gRPC-facing package --
+	// same reasoning as AgentCheckIn/AgentOverride below.
+	Command string
+}
+
+// AgentCommandRestart is the one supported value for
+// CheckInResult.Command / the agents table's pending_command column --
+// see agent_control.proto's AgentCommand enum comment for why STOP/
+// UNINSTALL aren't here yet.
+const AgentCommandRestart = "restart"
+
 // AgentCheckIn is what an agent reports about itself on each CheckIn --
 // a plain-Go mirror of agentv1.ReportedConfig plus the identity/
 // tenant fields, kept separate from the proto type so AgentRegistry
@@ -250,7 +273,7 @@ func (s *Server) CheckIn(ctx context.Context, req *agentv1.CheckInRequest) (*age
 	}
 
 	cfg := req.GetCurrentConfig()
-	override, err := s.agents.CheckIn(ctx, tenantID, AgentCheckIn{
+	result, err := s.agents.CheckIn(ctx, tenantID, AgentCheckIn{
 		Host:                   req.GetHost(),
 		Service:                req.GetService(),
 		AgentVersion:           cfg.GetAgentVersion(),
@@ -267,20 +290,27 @@ func (s *Server) CheckIn(ctx context.Context, req *agentv1.CheckInRequest) (*age
 		return nil, status.Errorf(codes.Internal, "recording check-in: %v", err)
 	}
 
-	if !override.HasOverride {
-		return &agentv1.CheckInResponse{HasOverride: false}, nil
+	resp := &agentv1.CheckInResponse{HasOverride: result.Override.HasOverride}
+	if result.Override.HasOverride {
+		resp.Override = &agentv1.DesiredOverride{
+			BatchMaxSize:         result.Override.BatchMaxSize,
+			BatchFlushIntervalMs: result.Override.BatchFlushIntervalMS,
+			HeartbeatEnabled:     result.Override.HeartbeatEnabled,
+			HeartbeatIntervalMs:  result.Override.HeartbeatIntervalMS,
+			JournaldUnit:         result.Override.JournaldUnit,
+			Version:              result.Override.Version,
+		}
 	}
-	return &agentv1.CheckInResponse{
-		HasOverride: true,
-		Override: &agentv1.DesiredOverride{
-			BatchMaxSize:         override.BatchMaxSize,
-			BatchFlushIntervalMs: override.BatchFlushIntervalMS,
-			HeartbeatEnabled:     override.HeartbeatEnabled,
-			HeartbeatIntervalMs:  override.HeartbeatIntervalMS,
-			JournaldUnit:         override.JournaldUnit,
-			Version:              override.Version,
-		},
-	}, nil
+	switch result.Command {
+	case AgentCommandRestart:
+		resp.PendingCommand = agentv1.AgentCommand_AGENT_COMMAND_RESTART
+		s.logger.Info("delivering restart command to agent", "host", req.GetHost())
+	case "":
+		// nothing pending
+	default:
+		s.logger.Error("agent registry returned an unknown command, ignoring", "host", req.GetHost(), "command", result.Command)
+	}
+	return resp, nil
 }
 
 // bearerTokenFromContext reads the same "authorization: Bearer <token>"