Add probo-agent CLI and deviceagent library

Introduce the standalone device agent binary and shared library
for enrollment, posture checks, self-update, and OS service
integration. Include build targets, module deps, and release
workflow so the agent can ship independently of server changes.

Signed-off-by: Bryan Frimin <bryan@probo.com>

cmd/probo-agent/installer/macos/scripts/postinstall

@@ -0,0 +1,92 @@
+#!/bin/bash
+#
+# probo-agent macOS PKG postinstall script.
+#
+# Runs as root inside the macOS Installer.app sandbox after the
+# payload has been laid down. Standard pkgbuild positional args:
+#
+#   $1 = full path to the component package
+#   $2 = full path to the install location (selected target)
+#   $3 = mountpoint of the destination volume
+#   $4 = root directory ("/" for the target volume)
+#
+# We intentionally do not abort the install if enrollment fails:
+# the binary is laid down regardless, and the operator can finish
+# enrollment with `sudo probo-agent install ...` from Terminal.
+
+set -u
+
+LOG_FILE="/var/log/probo-agent-install.log"
+BINARY="/usr/local/bin/probo-agent"
+STATE_DIR="/var/lib/probo-agent"
+CONF_FILE="/tmp/probo-agent.conf"
+
+# Mirror everything to the install log. We keep stdout/stderr open
+# too so failures still surface in macOS Installer.app's log pane.
+mkdir -p "$(dirname "${LOG_FILE}")"
+exec > >(tee -a "${LOG_FILE}") 2>&1
+
+echo
+echo "=== probo-agent postinstall $(date -u +%Y-%m-%dT%H:%M:%SZ) ==="
+echo "pkg=$1 target=$2 mount=$3 root=$4"
+
+if [ ! -x "${BINARY}" ]; then
+    echo "error: expected binary not found at ${BINARY}"
+    exit 1
+fi
+
+mkdir -p "${STATE_DIR}"
+chown root:wheel "${STATE_DIR}"
+chmod 0700 "${STATE_DIR}"
+
+# An admin (or MDM) may stage /tmp/probo-agent.conf to drive an
+# unattended enrollment. Recognized keys (shell-style):
+#
+#   PROBO_SERVER_URL=https://app.getprobo.com
+#   PROBO_ENROLLMENT_TOKEN=<token>
+#   PROBO_NO_AUTO_UPDATE=true
+#
+# We source the file in a subshell so a malformed line can never
+# leak variables into our env, then validate the values we care
+# about.
+if [ -f "${CONF_FILE}" ]; then
+    echo "Found ${CONF_FILE}, attempting unattended enrollment."
+
+    eval "$(
+        set -e
+        # shellcheck source=/dev/null
+        . "${CONF_FILE}"
+        printf 'CONF_SERVER=%q\n'  "${PROBO_SERVER_URL:-}"
+        printf 'CONF_TOKEN=%q\n'   "${PROBO_ENROLLMENT_TOKEN:-}"
+        printf 'CONF_NOUPDATE=%q\n' "${PROBO_NO_AUTO_UPDATE:-}"
+    )"
+
+    if [ -z "${CONF_SERVER}" ] || [ -z "${CONF_TOKEN}" ]; then
+        echo "warning: ${CONF_FILE} is missing PROBO_SERVER_URL or PROBO_ENROLLMENT_TOKEN; skipping enrollment."
+    else
+        EXTRA_FLAGS=()
+        case "${CONF_NOUPDATE}" in
+            1|true|TRUE|yes|YES) EXTRA_FLAGS+=("--no-auto-update") ;;
+        esac
+
+        if "${BINARY}" install \
+                --server "${CONF_SERVER}" \
+                --enrollment-token "${CONF_TOKEN}" \
+                "${EXTRA_FLAGS[@]}"; then
+            echo "Device enrolled and service installed."
+        else
+            echo "warning: probo-agent install failed; the binary is in place and can be re-run by an admin."
+        fi
+    fi
+
+    # The token in the conf file is sensitive; clear it whatever
+    # the outcome so a successful install does not leave secrets
+    # in /tmp.
+    rm -f "${CONF_FILE}"
+else
+    echo "No ${CONF_FILE} found; skipping automatic enrollment."
+    echo "Finish setup with: sudo ${BINARY} install --server <URL> --enrollment-token <TOKEN>"
+fi
+
+echo "=== postinstall done ==="
+exit 0