fix(fleet): slm-agent 404 heartbeat backoff + vnc target_path detection + optional-role health classification (#9965)

[mrveiss]

Thinking Path

Fresh 2-node install showed degraded fleet health from two independent facets: (1) the VM slm-agent died after early-404 heartbeats (posted before its node row existed), and (2) the wizard flagged optional roles (vnc/docker/browser-service/tts-worker) as "missing" even though vnc was actually running — its registry entry had no target_path so role_detector.py skipped it.

What Changed

Facet 1 — agent resilience (slm/agent/agent.py + Ansible payload copy + autobot-slm-agent/agent.py):

• _send_heartbeat_request now treats 404 as "registration pending" with bounded exponential backoff (5s→…→300s cap) instead of fatal; clears backoff + logs INFO on first 200.
• run() loop body wrapped in try/except Exception (log + continue) so a transient error can't kill the daemon; sleep honours the backoff.

Facet 2 — role detection + health classification:

• services/role_registry.py — gave vnc a real target_path (/usr/bin/Xtigervnc) so detection activates it (mirrors the feat(slm/roles): add canonical postgres + scheduler roles to role registry #9853 postgres fix).
• autobot-slm-agent/role_detector.py — load_definitions guard now also keeps roles with a systemd_service (not just target_path), aligning with the canonical agent copy.
• api/setup_wizard.py validate_fleet — only required=True roles count toward health=degraded; required=False inactive roles report in a new informational inactive_optional_roles field. Fail-safe defaults to required when the DB row is absent.

Verification

• tests/services/test_role_registry.py → 14/14 (3 new: vnc target_path, vnc in defs, optional-not-required).
• slm/agent/ tests → 26/28 (2 pre-existing failures unrelated: notification_service path conflict).
• py_compile clean on all 8 changed files.
• Closes Fleet health degraded on fresh install: VM agent dies after early-404 heartbeats + optional assigned roles never activate (vnc detection gap) #9965.

Caveat

Facet-1 exact crash path couldn't be confirmed without VM logs; the two most-likely causes (unhandled loop exception, no 404 handling) are addressed. If systemd WatchdogSec was the killer, unit-file tuning would be a separate follow-up.

Model Used

Claude Opus 4.8 (senior-backend-engineer subagent).

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No hardcoded values detected that have SSOT config equivalents!