Stable v2.6.20

• fix(agent): self-heal MariaDB provider plugins autoremoved by the vendor upgrade
• style(acme): fix misspell honour->honor (golangci-lint gate)
• feat(ssl): TLS-Health distinguishes 'waiting for DNS' from actionable SAN drift
• fix(ssl): show Let's Encrypt's real retry-after on rate-limit errors + honour it
• feat(updates): controlled downgrade to the channel version + drift explanation