fleet-agent: on-host TPM-mTLS telemetry client (v1)

Build the on-host agent that pairs with fleet-hostapi and feeds the
fleet-manager control plane (TODO #14 "STILL TO BUILD (a)"). Nothing on the
workstation talked to the manager before this; Monitor + InfluxDB stayed empty.

Scope: telemetry only. The agent reuses the host TPM identity for mTLS (read-only
tpmkey.LoadSigner at 0x81000100 + cert from NV 0x01800100; the private key never
leaves the TPM), opens the long-lived FleetAgent.Session bidi stream, sends Hello
+ periodic HealthSnapshot (load/cpu/temp/mem/tmpfs/nvme/auth/selinux/chrony/kiosk,
probed read-only from /proc+/sys plus hostapi facts), and LOGS but does not act on
the DesiredState/Command it receives. Reconcile actuators (kiosk URL, reboot,
drain) are deferred until the telemetry half is bench-verified.

- files/agent/: new module (go-tpm + grpc), static CGO_ENABLED=0 like enrol/hostapi.
  Copies the enrol tpmkey (+ read-only LoadSigner) and the generated fleet.agent.v1
  proto so it stays self-contained without importing the initramfs enrol module.
- files/agent/simtest/: proves the TPM-signed cert completes a real mTLS client-auth
  handshake (RequireAndVerifyClientCert) against the go-tpm software simulator.
- files/etc/fleet-agent/agent.env: fleet-generic config (manager DNS name, fleet CA
  reused from radius-ca.pem, TPM handle/nvindex, interval). No per-host state.
- fleet-agent.service: hardened unit (tss group for /dev/tpmrm0, INET egress).
- CI builds fleet-agent out-of-VM + runs vet/test + the simulator handshake test.
- Packer: enable_agent flag (default on) + 2b-agent provisioner + fapolicyd trust.
  Post-switch-root only, so no dracut/initramfs changes.
- docs: TODO #14 + fleet-management-design as-built updated.

Requires the host already enrolled (broker approve births the inventory row) —
else the manager returns PermissionDenied, the correct "not enrolled yet" signal.

files/agent/snapshot_test.go

@@ -0,0 +1,107 @@
+package main
+
+import (
+	"math"
+	"os"
+	"testing"
+)
+
+func approx(a, b float64) bool { return math.Abs(a-b) < 0.01 }
+
+func TestParseLoadAvg(t *testing.T) {
+	got := parseLoadAvg([]byte("0.42 0.31 0.19 1/234 5678\n"))
+	if !approx(got, 0.42) {
+		t.Fatalf("load = %v, want 0.42", got)
+	}
+	if v := parseLoadAvg([]byte("")); v != 0 {
+		t.Fatalf("empty load = %v, want 0", v)
+	}
+}
+
+func TestParseCPUStat(t *testing.T) {
+	total, idle, ok := parseCPUStat([]byte("cpu  100 0 50 800 50 0 0 0 0 0\ncpu0 1 2 3 4\n"))
+	if !ok {
+		t.Fatal("parseCPUStat not ok")
+	}
+	// total = 100+0+50+800+50 = 1000; idle = idle(800)+iowait(50) = 850.
+	if total != 1000 || idle != 850 {
+		t.Fatalf("total=%d idle=%d, want 1000/850", total, idle)
+	}
+}
+
+func TestCPUBusyPct(t *testing.T) {
+	// From (total 1000, idle 850) to (total 1100, idle 900): dTotal=100, dIdle=50
+	// → busy = 50/100 = 50%.
+	if got := cpuBusyPct(1000, 850, 1100, 900); !approx(got, 50) {
+		t.Fatalf("busy = %v, want 50", got)
+	}
+	// No forward progress → 0 (guards a counter reset / same sample).
+	if got := cpuBusyPct(1000, 850, 1000, 850); got != 0 {
+		t.Fatalf("no-delta busy = %v, want 0", got)
+	}
+	// idle jumping more than total is clamped, never negative.
+	if got := cpuBusyPct(1000, 850, 1100, 1000); got != 0 {
+		t.Fatalf("clamped busy = %v, want 0", got)
+	}
+}
+
+func TestParseMemUsedPct(t *testing.T) {
+	// total 1000, available 250 → used 75%.
+	mem := []byte("MemTotal:       1000 kB\nMemFree:  100 kB\nMemAvailable:    250 kB\n")
+	if got := parseMemUsedPct(mem); !approx(got, 75) {
+		t.Fatalf("mem used = %v, want 75", got)
+	}
+	if got := parseMemUsedPct([]byte("garbage")); got != 0 {
+		t.Fatalf("garbage mem = %v, want 0", got)
+	}
+}
+
+func TestParseHandle(t *testing.T) {
+	for _, tc := range []struct {
+		in   string
+		want uint32
+		bad  bool
+	}{
+		{"0x81000100", 0x81000100, false},
+		{"81000100", 0x81000100, false},
+		{"0X01800100", 0x01800100, false},
+		{"nope", 0, true},
+	} {
+		h, err := parseHandle(tc.in)
+		if tc.bad {
+			if err == nil {
+				t.Errorf("parseHandle(%q) = %#x, want error", tc.in, uint32(h))
+			}
+			continue
+		}
+		if err != nil || uint32(h) != tc.want {
+			t.Errorf("parseHandle(%q) = %#x, %v; want %#x", tc.in, uint32(h), err, tc.want)
+		}
+	}
+}
+
+func TestHostOf(t *testing.T) {
+	for _, tc := range []struct{ in, want string }{
+		{"diskless-server.bitasylum.org:9600", "diskless-server.bitasylum.org"},
+		{"host", "host"},
+		{"[2001:db8::1]:9600", "2001:db8::1"},
+	} {
+		if got := hostOf(tc.in); got != tc.want {
+			t.Errorf("hostOf(%q) = %q, want %q", tc.in, got, tc.want)
+		}
+	}
+}
+
+func TestReadKioskURL(t *testing.T) {
+	dir := t.TempDir()
+	f := dir + "/kiosk.env"
+	if err := os.WriteFile(f, []byte("# comment\nKIOSK_URL=\"http://boot.fleet.lab/kiosk/\"\nOTHER=x\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if got := readKioskURL(f); got != "http://boot.fleet.lab/kiosk/" {
+		t.Fatalf("kiosk url = %q", got)
+	}
+	if got := readKioskURL(dir + "/missing"); got != "" {
+		t.Fatalf("missing kiosk env = %q, want empty", got)
+	}
+}