P2.2-P2.9, P3.2-P3.10, P4.1-P4.3: Complete Phases 2, 3, and 4

11 work units built in parallel and merged:

Agent handlers (Phase 2):
- P2.2 Deploy: pull images, stop/remove/run containers, update registry
- P2.3 Lifecycle: stop/start/restart with desired_state tracking
- P2.4 Status: list (registry), live check (runtime), get status (drift+events)
- P2.5 Sync: receive desired state, reconcile unmanaged containers
- P2.6 File transfer: push/pull scoped to /srv/<service>/, path validation
- P2.7 Adopt: match <service>-* containers, derive component names
- P2.8 Monitor: continuous watch loop, drift/flap alerting, event pruning
- P2.9 Snapshot: VACUUM INTO database backup command

CLI commands (Phase 3):
- P3.2 Login, P3.3 Deploy, P3.4 Stop/Start/Restart
- P3.5 List/Ps/Status, P3.6 Sync, P3.7 Adopt
- P3.8 Service show/edit/export, P3.9 Push/Pull, P3.10 Node list/add/remove

Deployment artifacts (Phase 4):
- Systemd units (agent service + backup timer)
- Example configs (CLI + agent)
- Install script (idempotent)

All packages: build, vet, lint (0 issues), test (all pass).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/agent/testhelpers_test.go

@@ -0,0 +1,61 @@
+package agent
+
+import (
+	"context"
+	"log/slog"
+	"path/filepath"
+	"testing"
+
+	"git.wntrmute.dev/kyle/mcp/internal/config"
+	"git.wntrmute.dev/kyle/mcp/internal/registry"
+	"git.wntrmute.dev/kyle/mcp/internal/runtime"
+)
+
+// fakeRuntime implements runtime.Runtime for testing.
+type fakeRuntime struct {
+	containers []runtime.ContainerInfo
+	inspectMap map[string]runtime.ContainerInfo
+	listErr    error
+}
+
+func (f *fakeRuntime) Pull(_ context.Context, _ string) error               { return nil }
+func (f *fakeRuntime) Run(_ context.Context, _ runtime.ContainerSpec) error { return nil }
+func (f *fakeRuntime) Stop(_ context.Context, _ string) error               { return nil }
+func (f *fakeRuntime) Remove(_ context.Context, _ string) error             { return nil }
+
+func (f *fakeRuntime) List(_ context.Context) ([]runtime.ContainerInfo, error) {
+	return f.containers, f.listErr
+}
+
+func (f *fakeRuntime) Inspect(_ context.Context, name string) (runtime.ContainerInfo, error) {
+	if f.inspectMap != nil {
+		if info, ok := f.inspectMap[name]; ok {
+			return info, nil
+		}
+	}
+	for _, c := range f.containers {
+		if c.Name == name {
+			return c, nil
+		}
+	}
+	return runtime.ContainerInfo{}, nil
+}
+
+// newTestAgent creates an Agent with a temp database for testing.
+func newTestAgent(t *testing.T, rt runtime.Runtime) *Agent {
+	t.Helper()
+	db, err := registry.Open(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatalf("open test db: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	return &Agent{
+		Config: &config.AgentConfig{
+			Agent: config.AgentSettings{NodeName: "test-node"},
+		},
+		DB:      db,
+		Runtime: rt,
+		Logger:  slog.Default(),
+	}
+}