fix(provisioning): make wazuh-agent start best-effort

secharden-wazuh.sh did a hard `systemctl start wazuh-agent`. The agent
attempts to reach its manager (tsys-nsm.knel.net) during startup; when
that host is unreachable (e.g. an isolated lab/sandbox VM, or the SIEM
being temporarily down during a fresh build), systemd's start exceeds
its timeout and the whole provisioning aborts under the framework's
errexit.

The agent is already installed and enabled, so it will keep retrying the
manager on its own. Make the start non-fatal with `|| true` so a host can
finish building even when the manager isn't reachable at deploy time.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

ProjectCode/Modules/Security/secharden-wazuh.sh

@@ -50,7 +50,7 @@ WAZUH_MANAGER="tsys-nsm.knel.net" apt-get -y install wazuh-agent
 
 systemctl daemon-reload
 systemctl enable wazuh-agent
-systemctl start wazuh-agent
+systemctl start wazuh-agent || true
 
 echo "wazuh-agent hold" | dpkg --set-selections