feat(agent+panel): sing-box core version probe and display (round-2 #4)

agent-go: engineReport gains singBoxVersion. The probe runs
`sing-box version` once, parses the version token from its first line
('unknown' from unstamped builds reports empty), and caches it keyed by
the binary's mtime+size — re-probed only when an engine install/update
replaces the file. Steady-state heartbeats pay one stat, no subprocess.
Agent version stays 0.6.8.

panel-go: EngineState.singBoxVersion persisted from heartbeats (old
agents without the field keep showing '-'), servers table core-version
column now renders it. Golden gains heartbeatWithEngine +
serversAfterEngineHeartbeat sections locking the full chain, plus a
listen-address (<hostip>) normalization for the sandbox bind address.
singboxversion_test.go covers parsing, cache hits, and re-probe on
binary replacement.

panel-go/types.go

@@ -332,6 +332,7 @@ type EngineState struct {
 	SingBoxInstalled bool        `json:"singBoxInstalled"`
 	Certificates     []string    `json:"certificates"`
 	SingBoxStatus    string      `json:"singBoxStatus"`
+	SingBoxVersion   string      `json:"singBoxVersion,omitempty"`
 	At               string      `json:"at"`
 	Extra            extraFields `json:"-"`
 }