agent (unreleased): fixes after an independent review — one lock for the writers of agent.json, the trust run serialised and bounded, the CA copy keeps its previous root, the profile stanza from the wrapper's answer, a stale give-up ends, both boot tokens from one read

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/osupdate/leg.go

@@ -232,6 +232,7 @@ type Leg struct {
 	block        *hub.WireOSUpdate
 	profileAsk   string // how the last ask of the profile refresh ended in THIS process ("" = never asked)
 	profileAskAt time.Time
+	profileLast  ProfileRefreshStatus // the last refresh as the wrapper answered it to this process
 }
 
 // planFile / reportFile: the plan the agent writes and the copy of the report the wrapper keeps beside it (R-868).