feat(agent): keep samples and events on disk until the control plane accepts them

[nabil1440]

Layer 2 of 7 of the monitoring agent (#31 → #37).

Summary

• This PR adds a queue on the disk for the samples and the events.
• The agent removes data only when the control plane accepts it. If the control plane is not available, the agent keeps the data for up to 24 hours and sends it later.
• Each event keeps its id, so the control plane ignores an event that it already has.
• The agent examines each value before it sends it: one bad value can make the control plane refuse the whole request.
• The agent obeys the control plane when it tells the agent to wait. At start, it sends agent.started at once.
• A recovery is logged. After a failure that keeps the data (a 5xx or a network error, a 401 or a 429), the first request that succeeds logs one Info line: "the control plane accepts the requests again", with failing_for. The events and the samples log apart.

Change

• internal/agent/outbox.go: samples.json (at most 1440) and events.json.
• internal/agent/send.go: events first, then samples with the status; at most 100 events and 240 samples in each request; the reply rules of the contract (200, 400, 401, 422, 429, 5xx); a wait of 1, 2, 4, 8, then 10 minutes after failures.
• internal/agent/clean.go: the value ranges of the contract.
• internal/agent/wire: the JSON bodies of the contract.

Adversarial review

The first version was refuted. These items are fixed in this PR:

• Integers are capped at the signed 64-bit limit. A larger value made the control plane answer 500, and the agent resent it for 24 hours.
• Events and metrics wait on their own after a failure (maintainer decision). A broken events route no longer stops the metrics.
• A wait counts from the start of the report, so a 5 minute wait ends 5 minutes later, also with a slow control plane.
• A retry comes at the next tick that its wait allows, not after the next full report interval.
• When the time of a report runs out, the rest goes with the next report, with no backoff.
• The log shows the start of an error reply (for example the validation errors of a 400), and each item that a full queue drops.
• A queue file that cannot be read is kept as <name>.corrupt. A command id that is not a ULID is removed.

Tests

• Under testing/synctest with a fake control plane: each reply code, the backoff steps, resends with the same id, batches, a slow control plane, metrics while events fail, and the waits.
• End-to-end: a control plane on loopback gets agent.started with the token.

Closes #26
Closes #27