fleet-agent: on-host TPM-mTLS telemetry client (v1)

Build the on-host agent that pairs with fleet-hostapi and feeds the
fleet-manager control plane (TODO #14 "STILL TO BUILD (a)"). Nothing on the
workstation talked to the manager before this; Monitor + InfluxDB stayed empty.

Scope: telemetry only. The agent reuses the host TPM identity for mTLS (read-only
tpmkey.LoadSigner at 0x81000100 + cert from NV 0x01800100; the private key never
leaves the TPM), opens the long-lived FleetAgent.Session bidi stream, sends Hello
+ periodic HealthSnapshot (load/cpu/temp/mem/tmpfs/nvme/auth/selinux/chrony/kiosk,
probed read-only from /proc+/sys plus hostapi facts), and LOGS but does not act on
the DesiredState/Command it receives. Reconcile actuators (kiosk URL, reboot,
drain) are deferred until the telemetry half is bench-verified.

- files/agent/: new module (go-tpm + grpc), static CGO_ENABLED=0 like enrol/hostapi.
  Copies the enrol tpmkey (+ read-only LoadSigner) and the generated fleet.agent.v1
  proto so it stays self-contained without importing the initramfs enrol module.
- files/agent/simtest/: proves the TPM-signed cert completes a real mTLS client-auth
  handshake (RequireAndVerifyClientCert) against the go-tpm software simulator.
- files/etc/fleet-agent/agent.env: fleet-generic config (manager DNS name, fleet CA
  reused from radius-ca.pem, TPM handle/nvindex, interval). No per-host state.
- fleet-agent.service: hardened unit (tss group for /dev/tpmrm0, INET egress).
- CI builds fleet-agent out-of-VM + runs vet/test + the simulator handshake test.
- Packer: enable_agent flag (default on) + 2b-agent provisioner + fapolicyd trust.
  Post-switch-root only, so no dracut/initramfs changes.
- docs: TODO #14 + fleet-management-design as-built updated.

Requires the host already enrolled (broker approve births the inventory row) —
else the manager returns PermissionDenied, the correct "not enrolled yet" signal.

.gitea/workflows/gitea-main-ci.yaml

@@ -197,14 +197,14 @@ jobs:
           go-version: '1.26.4'
 
       -
-        name: Build host Go binaries out-of-VM (fleet-enrol, fleet-hostapi)
+        name: Build host Go binaries out-of-VM (fleet-enrol, fleet-hostapi, fleet-agent)
         # Built HERE on the runner, NOT inside the Packer VM, so the Rocky build
         # image never carries the Go toolchain or the go-tpm dep tree. Packer
         # file-provisions the resulting static binaries into the rootfs. Runs
         # BEFORE packer validate/build so the file provisioners' sources exist.
         # Reproducible: pinned Go (1.26.4) + go.sum-pinned deps + -trimpath/no buildid.
-        # fleet-enrol fetches go-tpm from the proxy (pinned by go.sum); hostapi is
-        # stdlib-only (GOPROXY=off).
+        # fleet-enrol + fleet-agent fetch go-tpm/grpc from the proxy (pinned by
+        # go.sum); hostapi is stdlib-only (GOPROXY=off).
         # shell: bash is explicit — the Gitea/act runner defaults run steps to sh
         # (dash), where `set -o pipefail` is an illegal option. `set -e` is
         # load-bearing: without it a failed go build/test in the first ( … ) group
@@ -219,13 +219,20 @@ jobs:
           ( cd files/hostapi \
             && CGO_ENABLED=0 GOPROXY=off GOTOOLCHAIN=local \
                go build -trimpath -buildvcs=false -ldflags '-s -w -buildid=' -o bin/fleet-hostapi . )
-          file files/enrol/bin/fleet-enrol files/hostapi/bin/fleet-hostapi
+          ( cd files/agent \
+            && CGO_ENABLED=0 GOTOOLCHAIN=local \
+               go build -trimpath -buildvcs=false -ldflags '-s -w -buildid=' -o bin/fleet-agent . \
+            && CGO_ENABLED=0 go vet ./... && CGO_ENABLED=0 go test ./... )
+          file files/enrol/bin/fleet-enrol files/hostapi/bin/fleet-hostapi files/agent/bin/fleet-agent
 
       -
-        name: TPM enrolment ceremony test (go-tpm software simulator)
-        # Exercises the real key-gen/sign/NV path against a software TPM (CGO in a
-        # separate module, so the simulator never enters the shipped enrol build).
-        run: ( cd files/enrol/simtest && CGO_ENABLED=1 go test ./... )
+        name: TPM ceremony + agent mTLS tests (go-tpm software simulator)
+        # Exercises the real key-gen/sign/NV path (enrol) AND the reused-TPM mTLS
+        # client-auth handshake (agent) against a software TPM (CGO in separate
+        # modules, so the simulator never enters the shipped enrol/agent builds).
+        run: |
+          ( cd files/enrol/simtest && CGO_ENABLED=1 go test ./... )
+          ( cd files/agent/simtest && CGO_ENABLED=1 go test ./... )
 
       -
         name: packer init