feat: install/sync/RL hardening + upstream version sync subsystem

Agent + install:
- linux installer adds redflag-agent to docker group (idempotent;
  unblocks container scanner detection)
- install.sh / linux.sh.tmpl / windows.ps1.tmpl: detect existing
  refresh_token and skip --register (Flow 2: upgrade in place)
- agent_update.go: remove dead post-restart watchdog; add
  CleanupPostUpdateBackup() called after first successful check-in

Server + token model:
- 409 machine-already-registered now returns existing_agent_id,
  hostname, last_seen, remediation guidance
- RevokeAgent admin handler (invalidates refresh_tokens only)
- GetAgentsBoundToToken query + no-cascade invariant test
- Two-axis revocation locked in: registration_token revoke does NOT
  cascade to agent refresh_tokens

Supply chain (Shai-Hulud defense feature 1):
- services/package_age.go: npm + PyPI registry probes,
  EvaluatePackageAgeGate decision matrix (warn/block/off x
  above/below/unknown)
- ApproveUpdate / ApproveUpdates wired to age gate; stores
  package_published_at + supply_chain_age_check in metadata
- security_settings_service: supply_chain category defaults
  (min_package_age_hours=24, gate_enforcement=warn)

Rate limiting UI rewrite:
- Frontend was expecting per-endpoint configs + usage/summary
  routes that don't exist; backend has 6 named categories
- Rewrote RateLimiting.tsx, useRateLimits.ts, api.ts, types,
  Settings overview card to the real shape (Requests + Window in
  seconds + Enabled per category)

Agent Management UI:
- Replaced auto-pick-first-token with explicit dropdown showing
  prefix, label, seats_used/max_seats, expiry
- One-liner panel only renders when a token is selected; no more
  YOUR_REGISTRATION_TOKEN placeholder in copyable command
- Zero-token state surfaces "Generate Registration Token" CTA

Upstream version sync (new subsystem):
- Migration 035: tracked_software + upstream_drift_events
- ReleaseSource interface + Registry + Repology adapter +
  endoflife.date adapter
- Periodic Syncer goroutine with on-demand SyncOne; classifies
  drift severity (minor/major/eol); appends drift events
- /admin/upstream CRUD + drift + sync-now routes
- Dashboard "Stack Drift" panel (count + worst-3 + EOL flag)

Migration 035 runs idempotently on next startup.

README.md

@@ -21,7 +21,7 @@ That said, it works well for its intended use case. Issues and feedback welcome!
 Cross-platform agents • Web dashboard • Hardware binding • Ed25519 signing • Full error transparency • No enterprise BS
 
 ```
-v0.2.0 - May 2026
+v0.2.0.0 - May 2026
 ```
 
 **Latest:** Maintenance windows for gating installs by schedule, OSV.dev supply chain checks for npm/PyPI packages, TD-series security refactors (panic recovery, error transparency, main.go modularization), install URL auto-detection fix, Ed25519 key rotation support, replay attack protection, and the setup wizard now includes the agent-facing URL field. See the [changelog](#-tldr-changelog-dont-trust-the-transport-layer) below. [Update instructions here](#updating).
@@ -132,12 +132,31 @@ Get registration tokens from the web dashboard under **Settings → Token Manage
 
 ### Updating
 
-To update to the latest version:
+To update the server stack:
 
 ```bash
 git pull && docker-compose down && docker-compose build --no-cache && docker-compose up -d
 ```
 
+#### Agent self-update
+
+Agents accept an `update_agent` command from the dashboard. The flow:
+download → SHA-256 → Ed25519 signature → atomic binary swap → service restart.
+Completion is reconciled server-side once the new binary reports its version.
+
+**Requires a real service manager on the agent host** — Linux: `systemd` (unit
+`redflag-agent`); Windows: SCM (service `RedFlagAgent`). Container-only agent
+deployments (no `systemctl`, no `sc`) cannot self-update through this path: the
+restart command will fail and the deferred rollback restores the previous
+binary. For containerized agents, redeploy with the new image instead.
+
+If a self-update times out without the new version attesting (`agent_update`
+system event with subtype `timed_out`, severity `error`), the previous binary
+is preserved at `<binary>.bak` on the agent host
+(`/usr/local/bin/redflag-agent.bak` on Linux,
+`C:\Program Files\RedFlag\redflag-agent.exe.bak` on Windows). Restore manually
+and restart the service.
+
 ---
 
 <details>
@@ -164,7 +183,7 @@ docker-compose down -v --remove-orphans && \
 **Warning:** This deletes everything - all agents, update history, configurations. You'll need to handle existing agents:
 
 **Option 1 - Re-register agents:**
-- Remove agent config: `sudo rm /etc/aggregator/config.json` (Linux) or `C:\ProgramData\RedFlag\config.json` (Windows)
+- Remove agent config: `sudo rm /etc/redflag/agent/config.json` (Linux) or `C:\ProgramData\RedFlag\agent\config.json` (Windows)
 - Re-run the one-liner installer with new registration token
 - Scripts handle override/update automatically (one agent per OS install)
 
@@ -441,7 +460,7 @@ If you're looking for an enterprise-grade solution with SLAs and support contrac
 
 ## 📜 **TLDR Changelog: Don't trust the transport layer**
 
-**v0.2.0 (May 2026)**:
+**v0.2.0.0 (May 2026)**:
 - ✅ Maintenance windows for scheduling/gating install operations
 - ✅ Supply chain vulnerability checks (OSV.dev) for npm/PyPI at approval time
 - ✅ Ed25519 key rotation with TTL-based auto-refresh