fleet-manager: checkpoint 2 — gRPC agent plane (bidi mTLS stream)

The steady-state host<->manager transport, resolving the design's OPEN FORK to
bespoke gRPC (not OTLP+Wazuh). One long-lived, host-dialed, mTLS bidi stream:
health/metrics up, desired-state/commands down — no polling, real-time control,
still no inbound host port.

- proto/fleet_agent.proto: FleetAgent.Session(stream AgentUp) -> stream ManagerDown.
  AgentUp = Hello | HealthSnapshot | CommandResult; ManagerDown = DesiredState |
  Command(reboot/drain/resync). int64 unix times (no well-known-type dep).
  Generated stubs committed (CI needs no protoc).
- agent.go: gRPC server with mTLS verified by the FLEET CA (the host's reused TPM
  identity cert — distinct from the admin plane's admin CA). Identity is the peer
  cert SERIAL, taken from the verified cert = inventory key, never self-asserted;
  an unenrolled serial is refused (enrolment gates the stream). Per-conn send
  channel decouples admin pushes from stream.Send. Stream registry (serial->conn)
  with reconnect eviction. On connect + on change, desired-state is pushed live;
  inventory stays authoritative so offline hosts reconcile on reconnect. Metrics
  go through a MetricsSink seam (no-op now; InfluxDB in ckpt 4).
- main.go: agent plane starts only when its cert/key/CA are set; admin can run
  standalone. Lifecycle PUT now live-pushes and reports pushed_live.

Full mTLS integration test (in-process fleet CA + host client cert): initial
desired-state on connect, Hello+snapshot -> inventory + online presence, live
desired-state push, and unenrolled-serial rejection. go build/test/vet/gofmt clean.

Deps (server-side only): google.golang.org/grpc + protobuf.

serving/fleet-manager/go.mod

@@ -7,9 +7,20 @@
 // so stdlib-only), this is a SERVER-SIDE service that ships as its own container
 // on the mgmt network — external deps are acceptable here. They are added at the
 // build checkpoint that needs them:
-//   - google.golang.org/grpc + protobuf : the agent bidi stream (checkpoint 2)
-//   - github.com/influxdata/influxdb-client-go/v2 : metrics read/write (ckpt 2/4)
-// Checkpoint 1 (this commit) is stdlib-only.
+//   - google.golang.org/grpc + protobuf : the agent bidi stream (added ckpt 2)
+//   - github.com/influxdata/influxdb-client-go/v2 : metrics read/write (ckpt 4)
 module fleet-manager
 
-go 1.22
+go 1.25.0
+
+require (
+	google.golang.org/grpc v1.82.0
+	google.golang.org/protobuf v1.36.11
+)
+
+require (
+	golang.org/x/net v0.53.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
+)