Add host-mode heartbeat: vetting-agent host + last-seen badge

vetting-agent gains a `host` subcommand that runs as a systemd service
installed by the quick-register one-liner, POSTing every 30s to
/api/v1/hosts/{mac}/heartbeat so the dashboard tile shows "online" or
"Nm ago" without waiting on WoL. Ships dormant client code for the
Phase 2 reboot_for_vetting command so the server can flip it on later
without a binary redeploy.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/orchestrator/runner.go

@@ -50,6 +50,13 @@ func (r *Runner) StartStage(ctx context.Context, runID int64, name string) error
 	return nil
 }
 
+// PublishTileUpdate is the exported entry point for non-orchestrator
+// callers (the UI heartbeat handler) that change tile-visible state
+// without going through Transition.
+func (r *Runner) PublishTileUpdate(ctx context.Context, hostID int64) {
+	r.publishTileUpdate(ctx, hostID)
+}
+
 func (r *Runner) publishTileUpdate(ctx context.Context, hostID int64) {
 	host, err := r.Hosts.Get(ctx, hostID)
 	if err != nil {