fix(agent): keep self-update off heartbeat path

[jmagar]

Summary

• run agent self-update outside the 30-second heartbeat cadence
• enforce single-flight updates so repeated directives cannot launch overlapping downloads
• use a dedicated updater HTTP client with 10s connect and first-byte limits, 15s chunk-idle timeout, and 60s total deadline
• stream downloads with a 128 MiB hard cap before SHA-256 verification and atomic installation
• preserve the existing validation, rollback marker, and re-exec behavior

Why

A stalled agent binary download previously blocked the heartbeat loop and made healthy hosts appear silent. This keeps heartbeats flowing while update work is bounded independently.

Validation

• cargo fmt --check
• git diff --check
• focused self-update suite: 14 passed, 0 failed
• repository pre-commit hooks
• repository pre-push contract, including clippy --all-targets --all-features --locked -D warnings