Add scale limit constants, stale-agent indexed query, and tests.

Extract fleet caps (128 hosts, sem=16, 250ms coalesce, syscheck=20) into
named constants with Go tests; wire ListStaleOnlineAgents for stale sweeps
instead of full ListAgents scans.

agent/client/syscheck_caps.go

@@ -0,0 +1,4 @@
+package client
+
+// SyscheckSubnetScanCap limits active /24 host probes during full_sys_check.
+const SyscheckSubnetScanCap = 20