Lands the deployment story for fjbagent on workers — cloud-init
installs the binary, drops a systemd unit + env file + auth token,
creates the unprivileged `fjb` system user, enables the service.
Opt-in: empty -fjbagent-token-file disables agent install entirely
so this is a no-op for deployments that haven't migrated yet.

Per-deployment knobs:
  - -fjbagent-token-file <path>   shared-secret bearer-token file;
                                  empty = agent install disabled.
  - -fjbagent-url <template>      URL template; {{.Version}} resolves
                                  to this daemon's build version,
                                  $rarch is left for cloud-init to
                                  substitute at boot. Default points
                                  at github releases for the matching
                                  fj-bellows version.

The agent's version is implicitly the same as the orchestrator's
build (linker-stamped main.version) — there is no per-deployment
agent version flag, because agent + orchestrator share a proto and
must come from the same commit. Pre-existing workers from before an
orchestrator upgrade keep running the agent version they were
provisioned with; the proto's wire-compatibility discipline (no
field renumbering, additive only) is the contract that keeps the
upgraded orchestrator able to dial them.

Deploy artifacts (added to cloud-init.yaml.tmpl, gated on
FJBAgentDownloadURL being non-empty):
  - groups: [fjb], users: [{name: fjb, system, nologin}]
  - /etc/fjbagent/auth.token (mode 0600, owned by fjb:fjb)
  - /etc/default/fjbagent (FJBAGENT_LISTEN=0.0.0.0:9001)
  - /etc/systemd/system/fjbagent.service (Type=notify, hardening
    flags from the design doc)
  - /usr/local/bin/fjbagent fetched from the resolved URL
  - systemctl enable --now fjbagent

Agent gets sd_notify support so Type=notify works — net.DialUnix to
$NOTIFY_SOCKET, write "READY=1\n", inline (no go-systemd dep).

NOTE: this PR ships the wiring but does not by itself publish the
fjbagent binary at the default github releases URL. The release
pipeline (.github/workflows/ci.yml) needs a parallel change to
cross-compile fjbagent for linux-amd64 / linux-arm64 and attach the
artifacts to v* tag releases before any deployment can set
-fjbagent-token-file in production. Tracked in FJB-94 phase
follow-ups.

Tests:
  - 5 new bootstrap render tests: backward-compat (no artifacts when
    URL empty), full-render asserts (user creation, token file mode,
    systemd unit text, runcmd), token-required guard, URL resolution
    across default + custom templates.
  - Existing render tests + full repo `go test -race ./...` green.
  - golangci-lint clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>