fleet-agent: on-host TPM-mTLS telemetry client (v1)

Build the on-host agent that pairs with fleet-hostapi and feeds the
fleet-manager control plane (TODO #14 "STILL TO BUILD (a)"). Nothing on the
workstation talked to the manager before this; Monitor + InfluxDB stayed empty.

Scope: telemetry only. The agent reuses the host TPM identity for mTLS (read-only
tpmkey.LoadSigner at 0x81000100 + cert from NV 0x01800100; the private key never
leaves the TPM), opens the long-lived FleetAgent.Session bidi stream, sends Hello
+ periodic HealthSnapshot (load/cpu/temp/mem/tmpfs/nvme/auth/selinux/chrony/kiosk,
probed read-only from /proc+/sys plus hostapi facts), and LOGS but does not act on
the DesiredState/Command it receives. Reconcile actuators (kiosk URL, reboot,
drain) are deferred until the telemetry half is bench-verified.

- files/agent/: new module (go-tpm + grpc), static CGO_ENABLED=0 like enrol/hostapi.
  Copies the enrol tpmkey (+ read-only LoadSigner) and the generated fleet.agent.v1
  proto so it stays self-contained without importing the initramfs enrol module.
- files/agent/simtest/: proves the TPM-signed cert completes a real mTLS client-auth
  handshake (RequireAndVerifyClientCert) against the go-tpm software simulator.
- files/etc/fleet-agent/agent.env: fleet-generic config (manager DNS name, fleet CA
  reused from radius-ca.pem, TPM handle/nvindex, interval). No per-host state.
- fleet-agent.service: hardened unit (tss group for /dev/tpmrm0, INET egress).
- CI builds fleet-agent out-of-VM + runs vet/test + the simulator handshake test.
- Packer: enable_agent flag (default on) + 2b-agent provisioner + fapolicyd trust.
  Post-switch-root only, so no dracut/initramfs changes.
- docs: TODO #14 + fleet-management-design as-built updated.

Requires the host already enrolled (broker approve births the inventory row) —
else the manager returns PermissionDenied, the correct "not enrolled yet" signal.

files/etc/fleet-agent/agent.env

@@ -0,0 +1,29 @@
+# fleet-agent config — EnvironmentFile for fleet-agent.service.
+#
+# FLEET-GENERIC ONLY (invariant #1): every value here is identical for every host
+# of a release. Host identity is the TPM (signing key at the persistent handle +
+# cert in NV) resolved at runtime — nothing per-host is baked. Override per
+# environment by replacing this file (it is part of the immutable image, so a
+# change means a rebuild + re-sign, like any other baked config).
+
+# The fleet-manager agent plane (gRPC/mTLS). A DNS name, NOT a per-host value.
+# Reached from the authenticated host VLAN via the OPNsense L3 hop to the mgmt
+# plane (not the boot nginx). Set to your manager's real name:port.
+FLEET_AGENT_MANAGER=diskless-server.bitasylum.org:9600
+
+# Fleet CA that verifies the manager's server cert. This is the SAME step-ca root
+# that signs the host TPM certs + the RADIUS server cert, so we reuse the in-place
+# copy rather than duplicating it. Replace per environment with your real root
+# (the shipped files/etc/dot1x/radius-ca.pem is a placeholder — auth/telemetry
+# cannot succeed until it is the real fleet root).
+FLEET_AGENT_CA=/etc/dot1x/radius-ca.pem
+
+# TPM identity (overridable, mirrors rd.dot1x.handle / rd.dot1x.nvindex). These
+# MUST match what enrolment used: signing key at a non-reserved owner handle, cert
+# in an owner NV index.
+FLEET_AGENT_HANDLE=0x81000100
+FLEET_AGENT_NVINDEX=0x01800100
+
+# Health snapshot cadence and the loopback hostapi facts source.
+FLEET_AGENT_INTERVAL=30s
+FLEET_AGENT_HOSTAPI=http://127.0.0.1:9099/v1/host