Add host-mode heartbeat: vetting-agent host + last-seen badge

vetting-agent gains a `host` subcommand that runs as a systemd service
installed by the quick-register one-liner, POSTing every 30s to
/api/v1/hosts/{mac}/heartbeat so the dashboard tile shows "online" or
"Nm ago" without waiting on WoL. Ships dormant client code for the
Phase 2 reboot_for_vetting command so the server can flip it on later
without a binary redeploy.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

cmd/vetting-agent/main.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"errors"
 	"flag"
 	"log"
 	"os"
@@ -10,18 +11,10 @@ import (
 
 	"vetting/agent"
 	"vetting/agent/bootstate"
+	"vetting/agent/hostmode"
 )
 
 func main() {
-	cmdlinePath := flag.String("cmdline", "/proc/cmdline", "path to kernel cmdline (override for local testing)")
-	flag.Parse()
-
-	p, err := bootstate.ParseCmdline(*cmdlinePath)
-	if err != nil {
-		log.Fatalf("bootstate: %v", err)
-	}
-	log.Printf("vetting-agent starting: run=%d mac=%s orchestrator=%s", p.RunID, p.MAC, p.OrchestratorURL)
-
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
@@ -33,7 +26,34 @@ func main() {
 		cancel()
 	}()
 
-	if err := agent.Run(ctx, p); err != nil && err != context.Canceled {
+	// `vetting-agent host` = persistent reporter (systemd service on
+	// the installed host). No-arg = live-image agent that parses the
+	// boot cmdline — keeping the default preserves PXE/initrd scripts.
+	if len(os.Args) >= 2 && os.Args[1] == "host" {
+		runHost(ctx, os.Args[2:])
+		return
+	}
+	runLive(ctx)
+}
+
+func runLive(ctx context.Context) {
+	cmdlinePath := flag.String("cmdline", "/proc/cmdline", "path to kernel cmdline (override for local testing)")
+	flag.Parse()
+	p, err := bootstate.ParseCmdline(*cmdlinePath)
+	if err != nil {
+		log.Fatalf("bootstate: %v", err)
+	}
+	log.Printf("vetting-agent starting: run=%d mac=%s orchestrator=%s", p.RunID, p.MAC, p.OrchestratorURL)
+	if err := agent.Run(ctx, p); err != nil && !errors.Is(err, context.Canceled) {
 		log.Fatalf("agent: %v", err)
 	}
 }
+
+func runHost(ctx context.Context, args []string) {
+	fs := flag.NewFlagSet("host", flag.ExitOnError)
+	cfgPath := fs.String("config", "/etc/vetting/host-agent.yaml", "path to host-agent.yaml")
+	_ = fs.Parse(args)
+	if err := hostmode.Run(ctx, *cfgPath); err != nil && !errors.Is(err, context.Canceled) {
+		log.Fatalf("hostmode: %v", err)
+	}
+}