feat: updates.Apply with security scope, window deadline, busy guard and captured output

internal/sync/sync.go

@@ -482,7 +482,7 @@ func runInventory(ctx context.Context, cfg *config.Config) {
 
 func handleApplyUpdates(cfg *config.Config, cmd *pb.ServerCommand) {
 	log.Printf("applying OS updates (cmd=%s)…", cmd.CommandId)
-	if err := updates.ApplyAll(); err != nil {
+	if _, err := updates.Apply(updates.ApplyOptions{}); err != nil {
 		log.Printf("OS upgrade failed (cmd=%s): %v", cmd.CommandId, err)
 		return
 	}