Greptile Summary

This PR fixes a TOCTOU race condition in the triggerAgentUpdate mutation by force-refreshing dev release metadata from GitHub immediately before writing pendingAction. The dev release URL is a rolling pointer — new CI builds can replace the binary between when the fleet UI caches the version/checksum and when the user clicks Update.

Key improvements:

• checkDevAgentVersion(true) (force-refresh) is called whenever targetVersion starts with dev-
• If the fresh version differs from the cached one and a fresh checksum is available, both targetVersion and checksum are replaced before the DB write
• If the fresh version differs but no checksum can be retrieved, an INTERNAL_SERVER_ERROR is thrown immediately, preventing silent fallback to a known-stale checksum
• When the freshly-fetched version matches what the UI sent, no substitution is needed

The fix correctly handles the primary TOCTOU bug and the fallback-to-stale-checksum edge case that would perpetuate the infinite loop.

Confidence Score: 4/5

• Safe to merge — the TOCTOU race condition is correctly addressed with proper force-refresh and error handling.
• The fix is logically sound and correctly handles the race condition. The primary concern (stale checksum after binary replacement) is prevented by force-refreshing dev release metadata before DB write. The edge case where the fresh version differs but no checksum is available is properly handled with an explicit error throw rather than silent fallback. The only residual scenario is when fresh.latestVersion is null (GitHub entirely unreachable), in which case the code falls back to the DB-cached version; if that cached version equals the client-supplied targetVersion, the original checksum is used unchanged. This degraded-mode behavior is acceptable under truly exceptional circumstances (GitHub down) and does not constitute a correctness bug under normal operation.
• No files require special attention.

_{Last reviewed commit: 35d9d30}

@greptile review