command-lifecycle v2: add received state, disk-persisted dedup, authenticated download, timeout reconciler

Migration 033 adds the 'received' status to agent_commands so the server can
distinguish "agent confirmed receipt" from "sent but may be lost in flight."
Stuck-command re-issuance now excludes received commands — the TimeoutService
handles the longer timeout for those (default 30m) vs the per-poll re-issuer
(sent/pending at 5m).

The agent side: disk-persists executed command IDs to survive restart (closes
the in-memory-only dedup gap), reports received_command_ids on each check-in so
the server transitions sent→received before issuing new work, and authenticates
binary downloads with JWT+X-Machine-ID (was unauthenticated http.Get — would
401 in production).

TimeoutService extended with reconcileAgentUpdates: clears is_updating when
current_version matches updating_to_version (success), or after a 15m threshold
(timeout, with system_event) so the dashboard never shows "updating" forever.
isVersionUpgrade replaced with utils.IsNewerVersion (no panic on 2-part
versions, no false-reject on 4-part).

MarkCommand* failures elevated from [WARNING] to [ERROR] + should_retry
response hint so agents know to re-deliver results (silent drops were ETHOS #1
violations).

Fixes: build broken on public since eac8a012 (command.go accidentally emptied).

README.md

@@ -455,6 +455,11 @@ If you're looking for an enterprise-grade solution with SLAs and support contrac
 - ✅ Test suite: 170+ tests across 18 packages
 - ✅ Install URL auto-detection: backend uses REDFLAG_PUBLIC_URL, frontend :8080 → :31337
 - ✅ Setup wizard includes agent-facing URL field with auto-detect
+- ✅ Command lifecycle v2 (Migration 033): `received` state distinguishes "agent has it" from "lost in flight"; stuck-command re-issuance no longer fires blindly
+- ✅ Disk-persisted command deduplication: a restarted agent cannot re-execute a command issued within the 4h max-age window
+- ✅ Agent self-upgrade completion loop: TimeoutService reconciles `is_updating` on version attestation (success) or after threshold (timeout, with system_event)
+- ✅ Authenticated binary download: agent self-upgrade now reuses JWT + X-Machine-ID for the download endpoint (was unauthenticated, would 401 in production)
+- ✅ Surfaced MarkCommand* failures: silent warnings → ERROR logs + `should_retry` hint on the response (ETHOS #1)
 
 **v0.1.27 (Dec 2025, Christmas Release) 🎄**:
 - ✅ Hardware binding with machine fingerprinting (security differentiator)