Add host-mode heartbeat: vetting-agent host + last-seen badge

vetting-agent gains a `host` subcommand that runs as a systemd service
installed by the quick-register one-liner, POSTing every 30s to
/api/v1/hosts/{mac}/heartbeat so the dashboard tile shows "online" or
"Nm ago" without waiting on WoL. Ships dormant client code for the
Phase 2 reboot_for_vetting command so the server can flip it on later
without a binary redeploy.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Makefile

@@ -67,8 +67,8 @@ run: orchestrator ## Build and run orchestrator with example config
 	./bin/vetting$(if $(filter Windows%,$(UNAME_S)),.exe,) --config deploy/vetting.example.yaml
 
 .PHONY: install
-install: orchestrator-linux ## Run deploy/install.sh (must be run on the target LXC as root)
-	sudo ./deploy/install.sh --binary ./bin/vetting-linux-amd64
+install: orchestrator-linux agent-linux ## Run deploy/install.sh (must be run on the target LXC as root)
+	sudo ./deploy/install.sh --binary ./bin/vetting-linux-amd64 --agent-binary ./bin/vetting-agent.linux-amd64
 
 .PHONY: clean
 clean: ## Remove build artifacts