Restore agent update recovery and unblock provisioner image builds

Scope: source-based diagnosis of user-reported cloud-router warnings after router/dashboard deployment on 2026-11-05, followed by user-authorized urgent dashboard-only recovery fix. Remove the offline restriction on agent updates, retain duplicate-update protection and clarify best-effort delivery. Other maintenance gates and router protocol behavior remain unchanged. Urgent follow-up: provisioner release 1.2.3 image fails E0463 for core/std on x86_64-unknown-linux-musl. Ensure Docker build installs that target for the repository-selected Rust toolchain; perform bounded validation without a full release build/push. Preserve the already-verified dashboard edit. User requests no long reviews/testing cycles: run existing dashboard tests and build once, no review or browser cycle. No production access, service changes or deployment authorized/performed. Acceptance: trace both warning guards and recent protocol changes; validate the supplied box ID format; identify a safe recovery path and distinguish source evidence from unverified deployed versions. Dashboard fix acceptance: offline status does not block agent update; pending/in-flight updates still block duplicates; copy does not promise offline delivery; existing tests/build pass. Full protocol compatibility repair is deferred. Verified source findings: commit 2558c3a (#145) changed global PROVISIONING_PROTOCOL_VERSION from 1 to 3 for generic microphone assignments. cloud-router/src/provisioning.rs rejects announcements with any other version before inventory refresh/update completion; telemetry/cache.rs rejects both envelope and inner sample versions before acceptance. All five pasted machine IDs pass the current 32-character lowercase-hex rule. Therefore old v1 provisioners explain both warning classes after a router-only rollout; actual live payload versions and deployed revisions were not inspected, so deployment mismatch remains strongly supported rather than remotely confirmed. This is not the earlier sample clock-skew warning or evidence of a key mismatch. Recovery evidence: pre-change 27b6841 agent handle_agent_update validates box_id but not command version. Follow-up UI inspection corrects the initial recovery advice: BoxProvisionView.vue disables Update agent when offline, so rejected announcements eventually prevent dashboard-triggered updates. Authenticated POST /api/boxes/{box_id}/agent-update has no online gate and can still publish to existing boxes if the registry serves the intended upgraded binary and configured unit/credentials work. This API path is source-verified, not production-tested. A rollback is not technically necessary to send that request; dashboard-only recovery requires restoring compatibility or evaluating a coordinated rollback. Default manual unit is kaukus-provisioner-update.service. Agent release notes for #145 require coordinated router/agent/streamer/panel rollout for generic microphone protocol changes; do not blindly save new assignments to old runtimes. No need to delete/re-enroll boxes or rotate keys based on these warnings. Diagnosis acceptance met through guard/history inspection and a local format check of all supplied IDs. Dashboard recovery implemented locally in cloud-dashboard/src/views/BoxProvisionView.vue: removed offline guards from the agent-update button and handler; preserved commandBusy duplicate-update protection and all other maintenance gates; clarified last-announcement status, best-effort delivery and request acknowledgement. Verified git diff --check, all 40 existing dashboard tests and production build pass in one run. Build reports a large-chunk warning. No new regression test, browser test, review, cargo test, commit, live verification, agent update or deployment performed. User explicitly requested urgent minimal validation. Provisioner build blocker: kaukus-provisioner/Dockerfile now runs rustup target add x86_64-unknown-linux-musl after COPY, where rust-toolchain.toml selects the versioned toolchain. This ensures the build's active toolchain receives the musl standard library rather than relying on the base image's default toolchain target. git diff --check and docker buildx build --check --file kaukus-provisioner/Dockerfile . pass, with no Dockerfile warnings. This is configuration validation only; no full image compilation, embedded-key execution, release, push or deployment was performed. Release rerun is needed to verify the production build and make the new agent available. Implementation follow-up should decouple versioning of unchanged announcement/telemetry/control contracts from breaking assignment changes, preserve legacy capabilities and fail-closed generic assignments, add legacy regression fixtures and explicit received/expected-version diagnostics.