fleet-agent: install agent.env from /tmp/agent (complete staging fix)

Companion to the previous commit's file move: point the 2b-agent install at
/tmp/agent/agent.env (the agent's own upload) instead of the deleted
/tmp/etc-stage path, update the file-provisioner comment, the enable_agent var
description, and the TODO source-path reference. packer validate passes.

diskless.pkr.hcl

@@ -132,7 +132,7 @@ variable "kiosk_url" {
 
 variable "enable_agent" {
   type        = bool
-  description = "Build-time feature flag for the on-host fleet-agent (telemetry client that dials the fleet-manager over TPM-mTLS and streams health; docs/fleet-management-design.md). true (default) installs /usr/local/bin/fleet-agent + fleet-agent.service; false skips it (the auth stack still boots — the agent is a management add-on). Config is fleet-generic in files/etc/fleet-agent/agent.env; set the manager DNS name there per environment."
+  description = "Build-time feature flag for the on-host fleet-agent (telemetry client that dials the fleet-manager over TPM-mTLS and streams health; docs/fleet-management-design.md). true (default) installs /usr/local/bin/fleet-agent + fleet-agent.service; false skips it (the auth stack still boots — the agent is a management add-on). Config is fleet-generic in files/agent/agent.env; set the manager DNS name there per environment."
   default     = true
 }
 
@@ -265,9 +265,11 @@ build {
     destination = "/tmp/fleet-hostapi"
   }
 
-  # On-host fleet-agent: the systemd unit is staged from here; the static binary
+  # On-host fleet-agent: the systemd unit AND the baked fleet-generic config
-  # (built OUT OF THE VM like enrol/hostapi) is staged separately. The baked,
+  # (agent.env) are staged from here to /tmp/agent (installed in the 2b-agent step,
-  # fleet-generic config lands via the /tmp/etc-stage contents upload below.
+  # which runs AFTER /tmp/etc-stage is cleaned — so config must ride this upload,
+  # not files/etc). The static binary (built OUT OF THE VM like enrol/hostapi) is
+  # staged separately below.
   provisioner "file" {
     source      = "files/agent"
     destination = "/tmp/"
@@ -644,7 +646,7 @@ build {
       "if [ \"$ENABLE_AGENT\" != \"true\" ]; then echo 'enable_agent=false -> skipping fleet-agent install.'; exit 0; fi",
       "install -D -m0755 /tmp/fleet-agent /usr/local/bin/fleet-agent",
       "install -D -m0644 /tmp/agent/fleet-agent.service /etc/systemd/system/fleet-agent.service",
-      "install -D -m0644 /tmp/etc-stage/fleet-agent/agent.env /etc/fleet-agent/agent.env",
+      "install -D -m0644 /tmp/agent/agent.env /etc/fleet-agent/agent.env",
       "restorecon -R /usr/local/bin/fleet-agent /etc/systemd/system/fleet-agent.service /etc/fleet-agent 2>/dev/null || true",
       "systemctl enable fleet-agent.service",
       "rm -rf /tmp/agent /tmp/fleet-agent",

docs/TODO.md

@@ -1406,7 +1406,7 @@ the design forks resolved:
   **receives `DesiredState`/`Command` but only LOGS them** (zero host mutation).
   Static `CGO_ENABLED=0` binary built out-of-VM in CI (like enrol/hostapi), staged
   by the `2b-agent` provisioner (`enable_agent`, default on), fapolicyd-trusted,
-  fleet-generic config in `files/etc/fleet-agent/agent.env`. mTLS handshake proven
+  fleet-generic config in `files/agent/agent.env`. mTLS handshake proven
   end-to-end against the go-tpm software simulator (`files/agent/simtest`). No
   dracut/initramfs changes (post-switch-root only). **STILL TO BUILD (deferred):**
   the **reconcile actuators** — apply kiosk_url, reboot_at/REBOOT, drain — wired to