feat: answer ApplyUpdatesCmd with a PatchResult and reboot when the command asks

CLAUDE.md

@@ -93,8 +93,13 @@ too.
 
 ## What the agent will not do
 
-- **It never reboots a host.** `ApplyUpdatesCmd` installs and stops there;
-  `inventory.reboot_required` reports that one is owed.
+- **It reboots a host only when told to and only when owed.** An
+  `ApplyUpdatesCmd` with `reboot_if_required` set, on a host whose OS reports a
+  reboot is owed, with at least 5 minutes left before `deadline_unix`, reboots
+  after a one-minute grace period (`shutdown -r +1`, `shutdown /r /t 60`), and
+  only once the `PatchResult` announcing it has been sent. Anything else
+  installs and stops there, and `inventory.reboot_required` reports what is
+  owed.
 - **It decides what it will not touch.** The protected workload set is computed
   and enforced agent-side - `vantage-agent.service`, `VantageAgent` on Windows,
   and its own container ID from `/proc/self/cgroup`. The control plane may name
@@ -124,6 +129,17 @@ need a PowerShell Gallery install on every host and fails on an air-gapped
 fleet. `CurrentVersion` is empty on Windows and `NewVersion` carries the KB
 article ID: a Windows update is not a version bump of a named package.
 
+## Patching
+
+`updates.Apply` takes a scope and a deadline and answers with the tail of the
+package manager's output. Security-only uses `--security` on dnf/yum,
+`zypper patch --category security`, the Security and Critical classifications
+on Windows, and for apt a temporary `SourceParts` directory holding only the
+`-security` suites (with `APT::Get::List-Cleanup=0`, or the reduced update
+deletes every other list file). apk and pacman have no security metadata and
+report `unsupported`; security-only never falls back to installing
+everything. One run at a time: a second command answers `busy`.
+
 ## Two constants that mirror the control plane
 
 Neither can be shared - this is a separate module and the control plane's are