fix(agent): startup gate distinguishes shutdown-requested from ready

startup_gate_wait_for_ready() used to release a waiting module the
same way whether the startup hash actually validated or a shutdown
came in while it was still waiting -- the caller had no way to tell
the difference and would run its start routine either way. On a
module that starts and shuts down in the same second (SCA's
scan_on_start, run once from a Run()-local flag with no persisted
marker) that meant it could be gated open by a shutdown, start, and
have its first scan silently skipped for good: no error, no retry
until the next <interval>.

startup_gate_wait_for_ready() now returns an enum distinguishing
STARTUP_GATE_READY from STARTUP_GATE_SHUTDOWN_REQUESTED, and every
daemon entry point that gates on it (syscheckd, wazuh-modulesd,
wazuh-execd, wazuh-logcollector) exits without starting when a
shutdown is already in flight instead of racing ahead.

SCA additionally persists a first_scan_completed marker (alongside
the existing first_sync_completed/last_integrity_check pattern) so a
restart that interrupts it before its first scan finishes is picked
up on the next start instead of waiting a full <interval>, and logs a
debug-level line noting the skip -- this is a normal, expected
occurrence (e.g. restarting before the first scan), not an error.

Issue: #38428