[System]: OS logs silently not collected on Ubuntu 24.04 (journald-only) — noble missing from journald/logfile condition allowlist

### Integration Name

System [system]

### Dataset Name

system.syslog, system.auth

### Integration Version

2.20.0

### Agent Version

9.4.1 (Fleet-managed)

### OS Version and Architecture

Ubuntu 24.04.4 LTS (Noble Numbat), x86_64

### What did you do?

Enrolled elastic-agent 9.4.1 on Ubuntu 24.04 hosts and enabled the System integration (2.20.0) with both the logfile and journald inputs for `system.syslog`/`system.auth` at their default conditions.

### What did you see?

**Zero OS log documents** in `logs-system.syslog-*` / `logs-system.auth-*` over 7 days, across 6 hosts — with **no errors anywhere**:

- Ubuntu 24.04 ships **journald-only**: rsyslog is no longer part of the default install, so `/var/log/syslog` / `/var/log/auth.log` do not exist. The logfile input runs (its condition evaluates true) but finds no files.
- The journald input never starts: its default condition is an OS allowlist that does not include Ubuntu:

```
(${host.platform} != "windows") and (${host.os_version} == "12 (bookworm)" or ${host.os_version} == "13 (trixie)" or (${host.os_platform} == "amzn" and ${host.os_version} == "2023") or (${host.os_platform} == "sles" and (...15 SP1..SP7...)))
```

On these hosts the host provider reports `host.os_platform: ubuntu`, `host.os_version: "24.04.4 LTS (Noble Numbat)"` — no branch matches, the condition evaluates false, and the agent silently filters the input units out. `elastic-agent status --output full` shows no `journald-default` component, no registry/cursor is ever created, and nothing is logged about the dropped input.

Verification that the journald mechanism itself works on the same host: overriding the journald input's `condition` var to

```
(${host.platform} != "windows") and (${host.os_platform} == "ubuntu")
```

immediately starts the component (`journald-default` HEALTHY) and documents flow into both datasets (verified 1:1 against a temporary rsyslog+logfile setup on the same host). The facilities filter from the package template matches plenty of entries (`journalctl --facility=0,1,2,3,5,6,7,8,9,11,12,15` → ~840 entries/hour).

### What did you expect to see?

Ubuntu 24.04+ (noble and later) included in the journald default allowlist (and excluded in the logfile inverse condition), like Debian 12/13 — Ubuntu 24.04 is journald-only out of the box, exactly the situation the allowlist exists for.

### Anything else?

- Same bug class as #16026 (SLES missing from the allowlist, fixed in 2.18.0).
- #18637 tracks a structural replacement for these handcrafted conditions; until that lands, adding `ubuntu` + `24.04` (and later) to the generated defaults would fix silent data loss for what is currently the most widely deployed Ubuntu LTS.
- Workaround applied on our side: per-package-policy `condition` override as above (non-empty values persist across package upgrades, per #18637).
- Side note: the [host provider reference](https://www.elastic.co/docs/reference/fleet/host-provider) does not document the `host.os_platform` / `host.os_version` / `host.os_family` keys that these default conditions rely on (they are provided by the agent: `internal/pkg/composable/providers/host/host.go`).