chore(submodule): bump extensions/system → phase 4 (final stubs)

Bumps the system extension pointer to absorb Phase 4 of the agent
stub implementation plan:

  feat: phase 4 module authoring CLIs (commit/puppet apply) + server endpoints

Stubs landed: #13 commit, #17 puppet apply.

═══ ALL 18 STUBS COMPLETE ═══

Phase 0 — Shared infrastructure (3 commits):
  fsutil consolidation, transport.SwappableClient + io.EOF fix,
  mount.Lock flock helper, runtime.FetchAuthorizedKeys extraction,
  internal/{manifest,fleetevent,systemd,cli/} new packages,
  server: agent fleet events ingestion endpoint.

Phase 1 — Service-loop core (7 commits, autonomous reconciliation):
  oci.Puller HTTP-driven streaming pull, verify.Verifier interface,
  internal/runtime/{reconcile,cert_rotation}.go goroutines,
  internal/runtime/tasks/ loop + 9 handler files,
  K3s agent applier doc finalization,
  server: /enroll/refresh + /status/tasks/:id + modules OCI metadata.

Phase 2 — CLI module lifecycle (2 commits):
  init/verify/update/sync/attach/detach CLI commands wired,
  server: /modules/:id/rsync_spec + module member route fix.

Phase 3 — Boot orchestration + high-risk CLI (1 commit):
  internal/boot/ orchestrator (identity → enroll → mount → switch_root),
  exec CLI with privilege drop (drop_to_nobody/as_user/privileged-allowlist),
  volume-setup CLI with multi-layer safety guards,
  server: LUKS controller + disk_policy in /config.

Phase 4 — Module authoring CLIs (1 commit):
  commit CLI (rsync delta + secret scan + tar.zst + stage-or-push),
  puppet apply CLI (--noop first + change-count cap + identity-file refuse),
  server: /modules/:id/versions endpoint + AgentModuleCommitService.

Path migration (1 commit):
  Go module github.com/powernode/platform/extensions/system/agent →
  github.com/nodealchemy/powernode-system/agent + 49 import updates +
  docs/services/seeds/.gitmodules to nodealchemy org.

Plan reference: ~/.claude/plans/find-stubs-in-powernde-agent-kind-lecun.md

Author: rett