feat(agent): install signed releases by itself, one time each day

[nabil1440]

Closes #39.

Part of the monitoring agent stack. This PR is on top of #37.

What changes

• Release signature. A release can now have checksums.txt.sig. The file names the key, the tag and the time of the signature, and it has an ed25519 signature. The signature covers these lines and the bytes of checksums.txt.
• Signing tool. tools/releasesign makes a key pair, signs and verifies. make release-key makes the key. The maintainer signs on their own computer. The private key is never in GitHub.
• Sign only a release that builds again. make sign-release runs tools/sign-release.sh. It shows the commit of the local tag and asks to type the tag. It builds the release again from the local tag, with the Go version of the CI binaries, and compares the binaries byte for byte. If GitHub serves a different archive, or the tag on GitHub moved, the script stops before the signature. For this, the build date is now the date of the commit.
• Trusted keys. internal/release/keys.go holds the public keys. A build without a key does not update itself.
• Auto-update in the agent. One time each day, at a time from the server id, the agent gets the latest release. It installs the release only if all of these are true:
  • The release is newer. The agent never goes back to an older version.
  • The signature is correct.
  • The signature is more than 24 hours old.
• Off switch. FLY_AGENT_AUTO_UPDATE=off in /etc/fly/agent.env stops the check on one server. An unknown value gives a warning, and the agent continues.
• No auto-update for local builds. A make build after a tag (v0.2.0-3-gabcdef1, -dirty) does not update itself: the release would replace newer code.
• State fix. The state file now keeps all fields. Before, a new report interval would remove the time of the last check.
• Contract v0.3.1. The README pins v0.3.1. The agent sends updates_total and updates_security as null until apt-check gives a count. Before, it sent 0: a false "no updates". A later failed count sends the last counts again (v0.3.1 states this).
• Clock fix (for feat(agent): add fly agent run, the base of the monitoring agent #31). After the wall clock stepped back by more than a minute, the agent sent nothing for the size of the step. Now it skips a repeated minute only after a step of less than 2 minutes, and else follows the new clock. A repeated minute is harmless: the control plane keeps one sample for each minute.

agent.update does not change. It stays the fast path, and the recovery path if the key is lost or stolen.

Before release

• Done: internal/release/keys.go trusts the key 21ec14c790e96d62 ("server-cli release key for flywp"). A test fails if the list is empty.
• After the release workflow publishes a release, run make sign-release VERSION=<tag> KEY=<file or ->.

Tests

• Signature: round trip, a wrong key, a wrong tag, a changed checksum file, a changed time, a time in the future, a bad format.
• Agent (fake clock): one check each day at the slot, the 24 hour wait, no downgrade, no signature, a bad signature, GitHub down, a restart, a clock that was ahead, the off switch, a check while the events fail, and the state fix.
• End to end (Linux): a real fly agent run installs a signed release from a test GitHub, then exits.
• Sign script: a Linux build and a macOS build of one tag are the same. A swapped archive, an extra name in checksums.txt, and a missing local tag stop the script, and no signature is written.
• Clock: steps back of 90 seconds, one hour and one year.
• make check passes.