Fix codebase antipatterns: sentinel errors, error wrapping, debug cleanup

[Copilot]

Sweep of common Go antipatterns across the codebase.

• Sentinel errors: Extract inline errors.New()/fmt.Errorf() to package-level vars (ErrTunnelClosed, ErrHubConnectionClosed, ErrServeFailed, ErrInvalidPathPrefix, ErrExecutablePath) so callers can use errors.Is()
• Error wrapping: %v → %w in fmt.Errorf calls in pkg/cli/upgrade to preserve error chains
• Remove bare println(): Five debug println() calls writing to stderr in production with no log-level control
• Simplify log.Println(fmt.Sprintf(…)) → log.Printf(…)
• Fix defer resp.Body.Close() ordering: Moved before io.ReadAll in both agent/config and client/config so the body is closed even if the read fails
• Dead code removal: Commented-out // log.Println(err), commented-out function blocks, empty error branches

// Before
return nil, fmt.Errorf("tunnel closed")

// After
var ErrTunnelClosed = errors.New("tunnel closed")
// ...
return nil, ErrTunnelClosed

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.