feat: harden firewall policies telemetry and operations

Implement reliable agent apply, telemetry v2, analytics retention, guarded rollouts, enrollment, labels and webhooks. Improve ReUI frontend data safety and bounded list loading, and add Docker smoke, recovery and resource checks. Document local verification and pending native acceptance.

scripts/ci/linux-agent-fixture.test.py

@@ -0,0 +1,21 @@
+"""Pure contract regression; no sockets or firewall access."""
+import importlib.util
+import pathlib
+import unittest
+
+spec = importlib.util.spec_from_file_location("fixture", pathlib.Path(__file__).with_name("linux-agent-fixture.py"))
+fixture = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(fixture)
+
+
+class AcknowledgementTest(unittest.TestCase):
+    def test_exact_report_retry_has_stable_id_and_sequence_ack(self):
+        report = {"telemetry_version": 2, "report_id": "report-123", "sequence": 17}
+        expected = {"ok": True, "accepted": True, "report_id": "report-123", "sequence": 17}
+        self.assertEqual(fixture.acknowledgement(report), expected)
+        self.assertEqual(fixture.acknowledgement(dict(report)), expected)
+        self.assertNotEqual(fixture.acknowledgement({**report, "sequence": 18}), expected)
+
+
+if __name__ == "__main__":
+    unittest.main()