RFC 0001-P6: Agent self-sufficiency (SQLite + spool + reconnect)

Phase 6: agent self-sufficiency. Embed SQLite, persist what the agent needs to survive restarts and brief disconnects, and add a bounded telemetry spool for offline windows.

## Acceptance criteria

- Embed SQLite via `modernc.org/sqlite` (pure Go, no cgo). Migration framework for the agent-local DB.
- `device_cache` table: paired devices.
- `secret_cache` table: received `EncryptedSecretBundle` ciphertext payloads (NOT plaintext) so the agent doesn't need a full re-sync from the cloud on every restart.
- `command_inflight` table: replaces the phase-2 append-only file with the same semantics.
- `telemetry_spool`: bounded ring buffer for offline upload replay; size capped, drop-oldest policy when full to bound memory and DB pressure on reconnect.
- Agent runtime gains reconnect/backoff with a configurable grace period during which the agent serves cached state when offline; refuses new commands after grace expires.
- Spool replay on reconnect is rate-limited so it doesn't crowd out fresh telemetry or command results.

## Reference

RFC 0001 Phase 6: https://github.com/block/proto-fleet/pull/145

Start with RFC 0001 Phase 6 and review the existing phase-2 append-only file semantics. Then map the acceptance criteria for migrations, cached ciphertext, the bounded telemetry spool, reconnect grace periods, and rate-limited replay. Done means all listed persistence and offline behaviors are implemented and validated against the RFC.

Written by the indexing model from the issue text.