Sync upstream fleetdm/fleet@main into fork (incremental merge + fixes)

[oleksandrd-flamingo]

Description

Sync the fork with the latest upstream fleetdm/fleet@main. This is an incremental merge on top of the previous upstream sync — git's merge base is the prior sync's upstream parent, so only the 24 new upstream commits had to be reconciled (not the full history). All OpenFrame fork features are preserved, and two issues the sync surfaced are fixed.

Keep this a merge commit — do not squash. The merge commit is what keeps the next weekly sync incremental (a squash would force the whole history to re-reconcile next time).

Improvements

• Merge upstream/main (585a065870) — 24 new upstream commits. 3 conflicts resolved:
  • cmd/fleet/serve.go — upstream extracted cron registration into cmd/fleet/cron_registration.go (Extract cron schedule registration out of runServeCmd fleetdm/fleet#47562); relocated the OpenFrame query_results_ttl_cleanup schedule into the new registerCleanupAndMaintenanceCrons.
  • charts/fleet/{Chart.yaml,values.yaml} — kept the fork's own release versioning (an upstream sync must not auto-bump the fork's chart/app/image versions).
• Relocate OpenFrame agent-auth package (712ae6e5ff) — upstream moved the orbit client into client/, which brought an arch-guard test (TestClientPackageDoesNotImportServerService) forbidding client from importing server/service*. The fork's agent-only, dependency-free server/service/openframe package was tripping it; moved it to pkg/openframe. No behavior change.
• Make re-timestamped upstream migrations idempotent (6b50679bc9) — upstream PR Re-timestamp migrations due to 4.79 cherry pick. fleetdm/fleet#37993 re-timestamped two migrations the fork already carries under their original timestamps; the merge kept both, so prepare db aborted with Duplicate column name on any DB that already ran the fork copies (i.e. every existing tenant). Guarded the two upstream copies with the fork's existing columnExists helper.
• Docs (7fb36394fe) — documented the duplicate-migration hazard, detection one-liner, and idempotency fix in openframe/docs/migrations.md.

Validation

• go build ./... green; fast and cmd/fleet (MySQL) Go test bundles green; client arch-guard test passes.
• End-to-end migration + boot test against real tenant data: dumped a live tenant-0 DB (read-only), restored into a local container, ran prepare db → all ~90 upstream tables + data + openframe migrations completed; server boots in FLEET_OPENFRAME_MODE with no migration warning, UI serves at /login, policy_hosts/query_hosts present, and the OpenFrame-gated cron registers. The live tenant DB was never modified.

Task

N/A — fork maintenance (weekly upstream sync).