Add scale limit constants, stale-agent indexed query, and tests.

Extract fleet caps (128 hosts, sem=16, 250ms coalesce, syscheck=20) into
named constants with Go tests; wire ListStaleOnlineAgents for stale sweeps
instead of full ListAgents scans.

agent/client/syscheck_caps_test.go

@@ -0,0 +1,9 @@
+package client
+
+import "testing"
+
+func TestSyscheckSubnetScanCap(t *testing.T) {
+	if SyscheckSubnetScanCap != 20 {
+		t.Fatalf("SyscheckSubnetScanCap = %d, want 20", SyscheckSubnetScanCap)
+	}
+}