Third slice of FJB-94. Lands the orchestrator-side dial — generic
agent.NewClient producing an AgentServiceClient given a DialContext,
addr, and bearer token — plus the cache cloud-init extension that
installs fjbagent on the cache nanode the same way Phase B installed
it on workers. Together with Phase A/B, this completes the FJB-94
foundation.

agent.NewClient:
  - DialContextFunc abstraction lets the orchestrator pass
    wg.Tunnel.DialContext in production, net.Dialer.DialContext in
    tests.
  - HTTP/2 cleartext via http2.Transport.AllowHTTP + DialTLSContext
    returning a plain TCP conn. Matches agent server-side h2c.
  - Bearer interceptor sets Authorization on both unary and
    streaming RPCs (FJB-93's Exec needs the streaming path).

Cache deploy:
  - cacheCloudInitParams gains FJBAgentDownloadURL + FJBAgentToken +
    FJBAgentServiceUnit + FJBAgentListenPort; ServiceUnit comes from
    bootstrap.FJBAgentServiceUnit() so worker and cache share one
    systemd unit file.
  - cache-cloud-init.yaml.tmpl mirrors the worker install block:
    same fjb system user, same auth.token mode 0600, same
    /etc/default/fjbagent env file, same systemd Type=notify unit,
    same curl-then-enable-service runcmd. Gated on
    FJBAgentDownloadURL non-empty.
  - Linode.SetFJBAgent is the duck-typed wiring main.go uses
    (matching SetTransportMode / SetACLSource shape); empty pair
    disables the install for the cache the same way it does for
    workers.

main.go:
  - buildOrchestratorConfig pushes the resolved knobs into the
    provider via duck typing inline (skip the docker provider, no-op
    when cache isn't configured). Locality > separate helper here
    since the call site is small.

Tests: 5 new agent.NewClient cases over h2c (Health no-auth + with
token + wrong-token rejected, Exec streaming with bearer, sentinel
DialContext is actually used), 3 new cache renderer cases. Full
go test -race ./... clean. golangci-lint clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>