Probe the installed tentacle with the version subcommand

Summary

Every leg of this workflow has been failing daily on main, for two separate reasons — neither of which indicates anything wrong with the published packages.

• apt legs asserted squid-tentacle --version. CommandResolver treats any leading - as a config flag and routes it to RunCommand, so --version starts the agent instead of printing a version; the probe captures no output and the step fails. This is a known trap in this repo: VersionCommand exists specifically to close it, and deploy/packaging/after-install.sh already uses the version subcommand with </dev/null and a timeout cap, citing a production hang observed in 1.4.1/1.4.2. This workflow was the one place that didn't follow that convention. Adopted the same three defences.
• rpm legs never reached the version probe: they call which, which RHEL 9 and current Fedora base images no longer ship, so the step exited 127 before verifying anything. Switched to command -v.

Test plan

• Confirmed which is absent from rockylinux:9 and fedora:40 and present on ubuntu:24.04 — matching exactly which legs failed with 127 vs. which reached the version probe
• Confirmed squid-tentacle version prints 1.9.4 on a real RPM install (squid-tentacle-1.9.4-1.x86_64 from the production repo), while squid-tentacle --version instead emits a startup log line and runs the agent
• CI confirmation across all five images

Notes

• fedora:40 is EOL upstream; the image still pulls, so it is left alone here. Bumping it is a separate call.
• No product change: --version still routes to RunCommand. That behaviour is documented in VersionCommand's remarks and worked around by callers; making --version an alias for the version subcommand would be a reasonable follow-up but is a CLI-contract decision, not a CI fix.