Queue the agent update job for one server

Explicit customer action. The control plane queues a single agent_upgrade job over the existing polling channel; the agent verifies the channel's signed release manifest (Ed25519, expiry, sequence chain, artifact digests) before swapping its own binary, keeps credentials, configuration and app containers untouched, and restores the previous binary if startup fails. The job is only reported as verified when the next heartbeat carries the target version. Refused while any operation is pending on the server, outside the maintenance window, when the agent is pinned, already current, or does not announce agent-upgrade-v1.