feat(api): implement self-update mechanism for Linux agents

- Added a `maybe_self_update` function in `evofw-firewall.sh` to allow agents to pull the latest version of the sync script from the server, enhancing the agent's ability to stay updated.
- Updated the `/v1/agent/sync-script` endpoint to return ETag and script SHA256 headers, enabling efficient caching and conditional requests.
- Modified the agent policy response to include `script_sha256`, providing visibility into the current version of the sync script.
- Enhanced tests to verify the self-update functionality and ensure correct behavior of the sync script endpoint.

These changes improve the maintainability and reliability of Linux agents by enabling automatic updates of critical scripts.

packages/shared/src/contracts.ts

@@ -444,6 +444,8 @@ export const agentPolicySchema = z.object({
   allow_cidrs: z.array(z.string()),
   port_rules: z.array(agentPolicyPortRuleSchema).optional(),
   sync_interval_sec: z.number().int(),
+  /** sha256 of GET /v1/agent/sync-script (Linux self-update). Not part of policy.hash. */
+  script_sha256: z.string().optional(),
 })
 
 export const agentPolicyPreviewSchema = z.object({