Add scale limit constants, stale-agent indexed query, and tests.

Extract fleet caps (128 hosts, sem=16, 250ms coalesce, syscheck=20) into
named constants with Go tests; wire ListStaleOnlineAgents for stale sweeps
instead of full ListAgents scans.

agent/client/syscheck.go

@@ -61,9 +61,9 @@ func CollectFullSysCheck(cfg config.RuntimeConfig, agentID string) *FullSysCheck
 	r.Neighbors.ArpHosts = arp
 	r.Neighbors.ArpCount = len(arp)
 	if subnetScanCollector != nil {
-		r.Neighbors.SubnetScan = subnetScanCollector(20)
+		r.Neighbors.SubnetScan = subnetScanCollector(SyscheckSubnetScanCap)
 	} else {
-		r.Neighbors.SubnetScan = deploy.ScanLocalSubnet(20)
+		r.Neighbors.SubnetScan = deploy.ScanLocalSubnet(SyscheckSubnetScanCap)
 	}
 
 	collectSysCheckPlatform(r)

agent/client/syscheck_caps.go

@@ -0,0 +1,4 @@
+package client
+
+// SyscheckSubnetScanCap limits active /24 host probes during full_sys_check.
+const SyscheckSubnetScanCap = 20

agent/client/syscheck_caps_test.go

@@ -0,0 +1,9 @@
+package client
+
+import "testing"
+
+func TestSyscheckSubnetScanCap(t *testing.T) {
+	if SyscheckSubnetScanCap != 20 {
+		t.Fatalf("SyscheckSubnetScanCap = %d, want 20", SyscheckSubnetScanCap)
+	}
+}