Port from 5.1.x hotfix line (815c990e). Adds privilege probing so
the host agent only requests PVE permissions that exist on the target
version (VM.Monitor on PVE 8, VM.GuestAgent.Audit on PVE 9+). Demotes
apt/update 403 to Debug. Setup script uses comma-separated privs and
modify-before-add for the PulseMonitor role.