Add tests for untested agent behaviors (traversal refusal, chown, debounce, noise suppression, decommission signal)

[LiorFink00]

Found during a full feature-coverage audit on main (fc58e08). These features work (verified live where reachable) — the gap is missing automated tests, not broken behavior.

agent/thumper_agent.sh behaviors with no test coverage:

• .. traversal-path refusal in plant() — defense-in-depth (server-side _validate_bait_path is tested; the agent's own guard is not).
• root / chown target-user planting (resolve_target_user, chown) — no test runs the agent as root / with SUDO_USER.
• Debounce (DEBOUNCE_SECS, all watchers) — no test fires twice rapidly and asserts a single callback.
• Noise-process suppression (is_noise/NOISE_PROCS) — no test.
• Server-initiated decommission (heartbeat returns "decommission" → kill -USR1 → self_destruct) — only the ephemeral SIGTERM path is tested.
• HMAC signature value — callback tests receive callbacks but never recompute/assert the signature. (Note: the live E2E proves it end-to-end — the real server accepted the agent's signed /trigger — but there's no unit assertion.)
• curl/openssl tool-preflight and --help/--version/unknown-arg/missing-required-arg exit paths.