fix: remove updates subsystem resurrection paths

The legacy "updates" virtual subsystem was deprecated (scheduler.go:159
skips it), but five paths kept re-creating the row in agent_subsystems:

- agent migration detection flagged missing "updates" subsystem as a
  missing security feature, prompting the executor to re-add it to the
  local config on every startup migration
- server install-config template, scanner-timeout list, and intervals
  map all kept "updates" alive in the config artifact sent to agents

Removed at all five sites. Scheduler skip logic, per-scanner mapping
helper (subsystems.go:236), and update-report data path remain — they
are not subsystem-row creators.

Historical migration 024_disable_updates_subsystem left intact.

agent/internal/migration/detection.go

@@ -426,9 +426,6 @@ func checkConfigSecurityFeatures(configPath string) []string {
 		if _, hasSystem := subsystems["system"]; !hasSystem {
 			missingFeatures = append(missingFeatures, "system_subsystem")
 		}
-		if _, hasUpdates := subsystems["updates"]; !hasUpdates {
-			missingFeatures = append(missingFeatures, "updates_subsystem")
-		}
 	} else {
 		missingFeatures = append(missingFeatures, "subsystem_configuration")
 	}

agent/internal/migration/executor.go

@@ -310,8 +310,6 @@ func (e *MigrationExecutor) applySecurityHardening() error {
 			fmt.Printf("[MIGRATION] Adding missing subsystem configurations\n")
 		case "system_subsystem":
 			fmt.Printf("[MIGRATION] Adding system scanner configuration\n")
-		case "updates_subsystem":
-			fmt.Printf("[MIGRATION] Adding updates subsystem configuration\n")
 		}
 	}
 

server/internal/api/handlers/downloads.go

@@ -424,17 +424,6 @@ func (h *DownloadHandler) HandleConfigDownload(c *gin.Context) {
 					"half_open_attempts": 2,
 				},
 			},
-			"updates": map[string]interface{}{
-				"enabled": true,
-				"timeout": 30000000000,
-				"circuit_breaker": map[string]interface{}{
-					"enabled":            false,
-					"failure_threshold":  0,
-					"failure_window":     0,
-					"open_duration":      0,
-					"half_open_attempts": 0,
-				},
-			},
 			"storage": map[string]interface{}{
 				"enabled": true,
 				"timeout": 10000000000,

server/internal/services/config_builder.go

@@ -526,7 +526,7 @@ func (cb *ConfigBuilder) overrideScannerTimeoutsFromDB(config map[string]interfa
 	}
 
 	// List of scanners that can have configurable timeouts
-	scannerNames := []string{"apt", "dnf", "docker", "windows", "winget", "system", "storage", "updates"}
+	scannerNames := []string{"apt", "dnf", "docker", "windows", "winget", "system", "storage"}
 
 	for _, scannerName := range scannerNames {
 		scannerConfig, exists := subsystems[scannerName].(map[string]interface{})

server/internal/services/config_service.go

@@ -94,9 +94,8 @@ func (s *ConfigService) GenerateNewConfig(agentCfg *AgentConfig) ([]byte, error)
 		ServerURL: serverURL,
 		LogLevel:  "info",
 		Intervals: map[string]int{
-			"metrics":  300,  // 5 minutes
-			"updates":  3600, // 1 hour
-			"commands": 30,   // 30 seconds
+			"metrics":  300, // 5 minutes
+			"commands": 30,  // 30 seconds
 		},
 		Subsystems:     subsystemMap, // ← USE DATABASE VALUES!
 		MaxRetries:     3,