feat: journal access notice, 1.60.0, install script, changelog, riscv protoc fallback

- Journal pane now distinguishes 'no entries' from 'no journal access':
  journalctl exits 0 with empty output when the agent's user simply can't
  see the target's entries (demo mode / user-run agents), explaining
  itself only on stderr. The agent forwards that hint as an additive
  JournalResponse.notice and the client renders it with practical advice.
  Verified E2E via a stub journalctl emulating the unprivileged case.
- Version 1.60.0 across all crates (1.51 would read fine, but the repo's
  scheme is 1.40/1.50/…, and a literal 1.6.0 would sort BELOW 1.50.0 in
  semver). All user-facing version strings already come from
  CARGO_PKG_VERSION — a stale binary was the only way to see an old one.
- scripts/install.sh: build-from-source install/upgrade for the test
  fleet (Linux + macOS). Detects in-repo checkouts, installs rustup when
  missing, replaces a systemd socktop-agent service binary in place and
  restarts it, requires system protoc on riscv64.
- build.rs (agent + connector): fall back to $PROTOC / PATH when
  protoc-bin-vendored has no binary for the host (riscv64) — native SBC
  builds previously panicked in the build script.
- CHANGELOG.md covering v1.50.0 -> 1.60.0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

socktop_connector/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "socktop_connector"
-version = "1.51.0"
+version = "1.60.0"
 edition = "2024"
 license = "MIT"
 description = "WebSocket connector library for socktop agent communication"

socktop_connector/build.rs

@@ -1,8 +1,12 @@
 fn main() -> Result<(), Box<dyn std::error::Error>> {
-    // Set the protoc binary path to use the vendored version for CI compatibility
-    // SAFETY: We're only setting PROTOC in a build script environment, which is safe
-    unsafe {
-        std::env::set_var("PROTOC", protoc_bin_vendored::protoc_bin_path()?);
+    // Vendored protoc for reproducible builds where available. It ships no
+    // riscv64 binary, so on such hosts leave $PROTOC / PATH lookup to
+    // prost-build (apt: protobuf-compiler).
+    // SAFETY: We're only setting PROTOC in a build script environment.
+    if let Ok(protoc) = protoc_bin_vendored::protoc_bin_path() {
+        unsafe {
+            std::env::set_var("PROTOC", protoc);
+        }
     }
 
     prost_build::compile_protos(&["processes.proto"], &["."])?;

socktop_connector/src/types.rs

@@ -55,7 +55,7 @@ pub struct GpuInfo {
 #[derive(Debug, Clone, Deserialize, Serialize)]
 pub struct Metrics {
     /// Epoch ms when the agent actually collected this snapshot (agents may
-    /// serve TTL-cached data). Absent on agents older than 1.51.
+    /// serve TTL-cached data). Absent on agents older than 1.60.
     #[serde(default)]
     pub sampled_at_ms: Option<u64>,
     pub cpu_total: f32,
@@ -151,6 +151,10 @@ pub struct JournalResponse {
     pub entries: Vec<JournalEntry>,
     pub total_count: u32,
     pub truncated: bool,
+    /// Agent-side explanation for an empty result (journal access limits).
+    /// Absent on agents older than 1.60.
+    #[serde(default)]
+    pub notice: Option<String>,
     pub cached_at: u64, // Unix timestamp when this data was cached
 }