feat(api): implement self-update mechanism for Linux agents

- Added a `maybe_self_update` function in `evofw-firewall.sh` to allow agents to pull the latest version of the sync script from the server, enhancing the agent's ability to stay updated.
- Updated the `/v1/agent/sync-script` endpoint to return ETag and script SHA256 headers, enabling efficient caching and conditional requests.
- Modified the agent policy response to include `script_sha256`, providing visibility into the current version of the sync script.
- Enhanced tests to verify the self-update functionality and ensure correct behavior of the sync script endpoint.

These changes improve the maintainability and reliability of Linux agents by enabling automatic updates of critical scripts.

docs/openapi.yaml

@@ -675,6 +675,28 @@ paths:
         '200':
           description: Shell script
 
+  /v1/agent/sync-script:
+    get:
+      summary: Linux sync agent (evofw-firewall.sh)
+      tags: [agent-public]
+      parameters:
+        - name: If-None-Match
+          in: header
+          schema: { type: string }
+          description: ETag from a previous GET (`"<sha256>"`)
+      responses:
+        '200':
+          description: Shell script
+          headers:
+            ETag:
+              schema: { type: string }
+              description: '"<sha256 of file bytes>"'
+            X-Evofw-Script-Sha256:
+              schema: { type: string }
+              description: Hex sha256 of the script body
+        '304':
+          description: Script unchanged
+
   /v1/agent/enroll:
     post:
       summary: Enroll agent (X-EvoFW-Seed)
@@ -690,7 +712,7 @@ paths:
       security: [{ agentToken: [] }]
       responses:
         '200':
-          description: Policy
+          description: Policy (includes script_sha256 for Linux self-update; not part of policy.hash)
 
   /v1/agent/policy.rsc:
     get: