Add scale limit constants, stale-agent indexed query, and tests.

Extract fleet caps (128 hosts, sem=16, 250ms coalesce, syscheck=20) into
named constants with Go tests; wire ListStaleOnlineAgents for stale sweeps
instead of full ListAgents scans.

agent/deploy/scale_limits_test.go

@@ -0,0 +1,26 @@
+package deploy
+
+import (
+	"testing"
+)
+
+func TestScaleLimitConstants(t *testing.T) {
+	if MaxSubnetScanHosts != 128 {
+		t.Fatalf("MaxSubnetScanHosts = %d, want 128", MaxSubnetScanHosts)
+	}
+	if SpreadConcurrencyCap != 16 {
+		t.Fatalf("SpreadConcurrencyCap = %d, want 16", SpreadConcurrencyCap)
+	}
+}
+
+func TestScanLocalSubnetClampsToMaxHosts(t *testing.T) {
+	_ = ScanLocalSubnet(999)
+	_ = ScanLocalSubnet(0)
+}
+
+func TestDiscoverLANSpreadTargetsClampsOverCap(t *testing.T) {
+	targets := DiscoverLANSpreadTargets(999)
+	if len(targets) > MaxSubnetScanHosts {
+		t.Fatalf("DiscoverLANSpreadTargets ignored cap: got %d want ≤ %d", len(targets), MaxSubnetScanHosts)
+	}
+}