[9.5](backport #7422) [Fleet] Write policy_base_id field at agent enrollment

[mergify]

Summary

Adds a denormalized policy_base_id field written at agent enrollment to enable cheap term/terms queries in place of expensive prefix/wildcard queries.

Background

Fleet supports version-specific agent policies where policy_id gets a #major.minor suffix (e.g. my-policy#9.2). Querying agents by policy currently requires:

{ "bool": { "should": [{ "term": { "policy_id": "my-policy" } }, { "prefix": { "policy_id": "my-policy#" } }] } }

The policy_base_id field stores the canonical base ID (suffix stripped), enabling a single term: { policy_base_id: "my-policy" } query instead.

Changes

• internal/pkg/dl/constants.go: Add FieldPolicyBaseID = "policy_base_id" constant
• internal/pkg/model/schema.go: Add PolicyBaseID string json:"policy_base_id,omitempty" field to the Agent model
• internal/pkg/api/handleEnroll.go: Set PolicyBaseID: policyBaseID(policyID) in the agent struct at enrollment; add policyBaseID helper that strips the #version suffix

Notes

• Checkin (bulk.go) writes agent_policy_id via partial update — no change needed there; policy_base_id tracks policy_id, not agent_policy_id
• Kibana backfills existing documents via update_by_query during Fleet setup (companion PR: [Fleet] Add policy_base_id field to eliminate prefix/wildcard agent policy queries (B2) kibana#279716)
• Companion ES mapping PR: [Fleet] Add policy_base_id field to fleet-agents and fleet-policies index templates elasticsearch#154521

Part of elastic/ingest-dev#8624 (Workstream B2).

---

This is an automatic backport of pull request #7422 done by Mergify.

[mergify]

This pull request is now in conflicts. Could you fix it @mergify[bot]? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b mergify/bp/9.5/pr-7422 upstream/mergify/bp/9.5/pr-7422
git merge upstream/9.5
git push upstream mergify/bp/9.5/pr-7422

[juliaElastic]

@ycombinator Could you help merge this backport?