Fix agent download serving wrong architecture binary

When a specific architecture is requested (e.g., linux-arm64), don't fall
back to the generic pulse-agent binary if the requested arch isn't found.
This was causing ARM64 machines to receive x86-64 binaries that can't run.

Now returns 404 with helpful error message if requested architecture
binary is not available.

internal/api/unified_agent.go

@@ -109,23 +109,26 @@ func (r *Router) handleDownloadUnifiedAgent(w http.ResponseWriter, req *http.Req
 	archParam := strings.TrimSpace(req.URL.Query().Get("arch"))
 	searchPaths := make([]string, 0, 6)
 
-	if normalized := normalizeUnifiedAgentArch(archParam); normalized != "" {
+	// If a specific architecture is requested, only look for that architecture
+	// Do NOT fall back to generic binary - that could serve the wrong architecture
+	normalized := normalizeUnifiedAgentArch(archParam)
+	if normalized != "" {
 		searchPaths = append(searchPaths,
 			filepath.Join(pulseBinDir(), "pulse-agent-"+normalized),
 			filepath.Join("/opt/pulse", "pulse-agent-"+normalized),
 			filepath.Join("/app", "pulse-agent-"+normalized),
 			filepath.Join(r.projectRoot, "bin", "pulse-agent-"+normalized),
 		)
+	} else {
+		// No specific architecture requested - allow fallback to generic binary
+		searchPaths = append(searchPaths,
+			filepath.Join(pulseBinDir(), "pulse-agent"),
+			"/opt/pulse/pulse-agent",
+			filepath.Join("/app", "pulse-agent"),
+			filepath.Join(r.projectRoot, "bin", "pulse-agent"),
+		)
 	}
 
-	// Default locations (host architecture)
-	searchPaths = append(searchPaths,
-		filepath.Join(pulseBinDir(), "pulse-agent"),
-		"/opt/pulse/pulse-agent",
-		filepath.Join("/app", "pulse-agent"),
-		filepath.Join(r.projectRoot, "bin", "pulse-agent"),
-	)
-
 	for _, candidate := range searchPaths {
 		if candidate == "" {
 			continue
@@ -154,5 +157,11 @@ func (r *Router) handleDownloadUnifiedAgent(w http.ResponseWriter, req *http.Req
 		return
 	}
 
-	http.Error(w, "Agent binary not found", http.StatusNotFound)
+	// Provide helpful error message
+	if normalized != "" {
+		log.Warn().Str("arch", normalized).Msg("Unified agent binary not found for requested architecture")
+		http.Error(w, "Agent binary not found for architecture: "+normalized, http.StatusNotFound)
+	} else {
+		http.Error(w, "Agent binary not found", http.StatusNotFound)
+	}
 }