This is configured with a default RPM installation: <entry key="rhq.agent.agent-update.enabled" value="true" /> I believe this needs to be false by default with in an RPM install because files installed by RPM should not be replaced through external means in a typical RPM system.
Agent auto-update has now been set to false for regular and EC2 RPMs.
JON RPM Agent is on the CP