Add host-mode heartbeat: vetting-agent host + last-seen badge

vetting-agent gains a `host` subcommand that runs as a systemd service
installed by the quick-register one-liner, POSTing every 30s to
/api/v1/hosts/{mac}/heartbeat so the dashboard tile shows "online" or
"Nm ago" without waiting on WoL. Ships dormant client code for the
Phase 2 reboot_for_vetting command so the server can flip it on later
without a binary redeploy.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

deploy/vetting.example.yaml

@@ -41,6 +41,13 @@ pxe:
   tftp_root: ""                          # holds ipxe.efi + undionly.kpxe
   live_dir: ""                           # holds vmlinuz + initrd.img; served at /live/*
 
+agent:
+  # Directory containing vetting-agent-linux-amd64. The quick-register
+  # one-liner downloads from /assets/vetting-agent-linux-amd64 and
+  # installs it as a systemd service so the host keeps heartbeating.
+  # Leave empty to disable the /assets/* route.
+  asset_dir: "./var/assets"
+
 # Notifications fire on StageFailed, SpecMismatch, HoldingOpened,
 # RunCompleted. Declare one or more notifiers and route each event
 # kind (and optionally severity) to a notifier by name. Delivery is