feat: add A/B partition updates with GRUB and Go update agent (Phase 3)

Implement atomic OS updates via A/B partition scheme with automatic
rollback. GRUB bootloader manages slot selection with a 3-attempt
boot counter that auto-rolls back on repeated health check failures.

GRUB boot config:
- A/B slot selection with boot_counter/boot_success env vars
- Automatic rollback when counter reaches 0 (3 failed boots)
- Debug, emergency shell, and manual slot-switch menu entries

Disk image (refactored):
- 4-partition GPT layout: EFI + System A + System B + Data
- GRUB EFI/BIOS installation with graceful fallbacks
- Both system partitions populated during image creation

Update agent (Go, zero external deps):
- pkg/grubenv: read/write GRUB env vars (grub-editenv + manual fallback)
- pkg/partition: find/mount/write system partitions by label
- pkg/image: HTTP download with SHA256 verification
- pkg/health: post-boot checks (containerd, API server, node Ready)
- 6 CLI commands: check, apply, activate, rollback, healthcheck, status
- 37 unit tests across all 4 packages

Deployment:
- K8s CronJob for automatic update checks (every 6 hours)
- ConfigMap for update server URL
- Health check Job for post-boot verification

Build pipeline:
- build-update-agent.sh compiles static Linux binary (~5.9 MB)
- inject-kubesolo.sh includes update agent in initramfs
- Makefile: build-update-agent, test-update-agent, test-update targets

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

build/scripts/build-update-agent.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+# build-update-agent.sh — Compile the KubeSolo OS update agent
+#
+# Builds a static Linux binary for the update agent.
+# Output: build/cache/kubesolo-update
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+UPDATE_DIR="$PROJECT_ROOT/update"
+CACHE_DIR="$PROJECT_ROOT/build/cache"
+OUTPUT="$CACHE_DIR/kubesolo-update"
+
+echo "=== Building KubeSolo Update Agent ==="
+
+# Ensure output dir exists
+mkdir -p "$CACHE_DIR"
+
+# Run tests first
+echo "--- Running tests ---"
+(cd "$UPDATE_DIR" && go test ./... -count=1)
+
+# Build static binary
+echo "--- Compiling static binary ---"
+(cd "$UPDATE_DIR" && CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -ldflags='-s -w' -o "$OUTPUT" .)
+
+SIZE=$(ls -lh "$OUTPUT" | awk '{print $5}')
+echo "--- Update agent built: $OUTPUT ($SIZE) ---"