v0.2.0: Fix List Jobs bug, TLS 1.3 enforcement, client_disconnect_timeout, RwLock contention

Bug fixes:
- Fix List Jobs connection reset: Add client_disconnect_timeout (5s) to prevent TLS write truncation
- Enforce TLS 1.3 only: Add with_protocol_versions(&[&TLS13]) to rustls ServerConfig
- Fix RwLock contention: Release read lock before sorting in list_jobs()
- Fix systemd service: Remove ProtectSystem=strict (blocks package management)
- Fix systemd service: Change Type=notify to Type=simple (fixes restart hangs)
- Fix systemd service: Add DEBIAN_FRONTEND=noninteractive
- Fix systemd service: Add ReadWritePaths for apt/dpkg paths

CI/CD:
- Add Ubuntu 22.04 build job to CI workflow

E2E Testing:
- Add comprehensive E2E test suite (test_e2e.py)
- Tests cover health, packages, patches, jobs, security, and reboot endpoints

Other:
- Bump version to 0.2.0
- Add lessons learned documentation

src/jobs/manager.rs

@@ -213,8 +213,11 @@ impl JobManager {
 
     /// List all jobs with optional status filter
     pub async fn list_jobs(&self, status_filter: Option<JobStatus>, limit: usize) -> Vec<Job> {
-        let jobs = self.jobs.read().await;
-        let mut result: Vec<Job> = jobs.values().cloned().collect();
+        // FIX: Clone under lock, then release before sorting to reduce lock contention
+        let mut result = {
+            let jobs = self.jobs.read().await;
+            jobs.values().cloned().collect::<Vec<Job>>()
+        }; // Lock released here
 
         // Filter by status if provided
         if let Some(status) = status_filter {