[client] Preserve posture checks on config-only sync updates

When management sends a MessageTypeControlConfig update (e.g. relay token
rotation), the SyncResponse carries no NetworkMap and no Checks. Moving the
updateChecksIfNew call after the nm == nil guard ensures posture checks are
only updated when a full network map is present, preventing relay token
rotation from silently clearing the previously applied posture check state.

client/internal/engine.go

@@ -914,15 +914,17 @@ func (e *Engine) handleSync(update *mgmProto.SyncResponse) error {
 		// todo update signal
 	}
 
-	if err := e.updateChecksIfNew(update.Checks); err != nil {
-		return err
-	}
-
 	nm := update.GetNetworkMap()
 	if nm == nil {
+		// config-only update (e.g. relay token rotation): posture checks and network map are intentionally absent,
+		// preserving the previously applied state
 		return nil
 	}
 
+	if err := e.updateChecksIfNew(update.Checks); err != nil {
+		return err
+	}
+
 	// Persist sync response under the dedicated lock (syncRespMux), not under syncMsgMux.
 	// A non-nil syncStore is what marks persistence as enabled. Hold the lock for
 	// the whole Set so the store cannot be cleared (disabled / engine close)