Add agent disk cleanup defaults

[techulus-agent]

Summary

Adds the first disk-cleanup slice for agent nodes:

• configures agent installer defaults for BuildKit GC, Traefik access-log rotation, and bounded journald storage
• runs agent cleanup on startup as well as hourly
• removes stale Techulus-owned build and backup/restore temp artifacts
• moves backup/restore temp archives under /var/lib/techulus-agent/tmp
• reports Podman image-prune failures instead of silently ignoring them

Notes

Registry manifest retention and safe registry GC are intentionally left for a separate change because reclaiming registry bytes needs manifest deletion plus a controlled GC window.

Validation

• bash -n web/public/setup.sh
• env GOCACHE=/private/tmp/techulus-go-cache go test ./... from agent/

[techulus-agent]

Review — Add agent disk cleanup defaults

Reviewed against main. Solid, well-tested change. Ran the agent Go tests (internal/build, internal/agent) and the web suite — all pass.

Verified / liked

• tempArtifactPath correctly confines archives to <dataDir>/tmp and rejects any non-base name (name != filepath.Base(name)), which blocks ../ traversal — nicely covered by TestTempArtifactPathRejectsNestedNames.
• Agent DataDir and Builder dataDir are the same path (both wired from dataDir in cmd/agent/main.go), so archives written under DataDir/tmp are exactly what cleanupManagedTempArtifacts scans under b.dataDir/tmp. The producer/consumer paths line up.
• Cleanup() now aggregates failures via errors.Join and ImagePrune surfaces podman errors instead of swallowing them — good observability upgrade. os.IsNotExist is tolerated in both scanners, so a missing dir is a clean no-op.
• Startup go a.RunBuildCleanup() is safe alongside the hourly ticker: the build-dir cutoff is 1h and temp-artifact cutoff is 24h, so in-flight builds/backups won't be reaped, and podman image prune --filter until=168h won't touch freshly-pulled base images.
• setup.sh changes are sensible (journald caps, Traefik logrotate with copytruncate, BuildKit GC policies). bash -n style guards (error on missing config) are in place.

Non-blocking notes

1. Stacked on #107 — this PR's diff includes web/lib/agent/expected-state.ts and web/tests/expected-state.test.ts, i.e. the certificate-domains change from #107. Worth being intentional about merge order: merge #107 first and this diff shrinks cleanly; merge this first and #107 becomes a near-empty PR. Not a correctness issue, just a heads-up so the history stays tidy.
2. managedTempArtifactPattern assumes a 36-char UUID backup ID ([0-9a-fA-F-]{36}). If a backup/restore ID is ever a different shape, its temp archive won't match the pattern and won't be reaped by the sweeper (the per-op defer os.Remove still handles the happy path; this only affects orphaned leftovers from a crash). Minor, and safely conservative in the other direction — just flagging in case ID formats change later.

Result: No blocking issues. LGTM 👍