Resolves#47285.
Final behavior (matches pre-1.56):
```
┌────────────────────┬─────────────────────────┬───────────────────────────────────────┐
│ command_line_flags │ wire config.Flags │ Orbit action │
├────────────────────┼─────────────────────────┼───────────────────────────────────────┤
│ Unset │ omitted (nil, len == 0) │ Preserve osquery.flags — return early │
├────────────────────┼─────────────────────────┼───────────────────────────────────────┤
│ null │ null (len == 4) │ Clear (parses to empty map) │
├────────────────────┼─────────────────────────┼───────────────────────────────────────┤
│ {} │ {} (len == 2) │ Clear (parses to empty map) │
├────────────────────┼─────────────────────────┼───────────────────────────────────────┤
│ {"verbose": true} │ non-empty │ Write flags │
└────────────────────┴─────────────────────────┴───────────────────────────────────────┘
```
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [X] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Preserve existing pre-packaged or user-provided osquery flagfiles when
the server omits flag configuration (no unintended clears or restarts).
* Treat an explicit empty flag payload (including JSON empty document or
JSON "null") as an instruction to clear flagfiles and queue a restart.
* **Tests**
* Expanded coverage to validate the preserve-vs-clear behavior for
unset, empty, and "null" flag payloads.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Lucas Manuel Rodriguez
4991b3c685