Stop macOS agent updates from spawning BTM entries

Unsigned darwin release tarballs replaced the Developer ID
binary on each auto-update, so Background Task Management
treated every release as a new identity and showed the generic
executable icon. Sign those archives with a stable identifier,
refuse signature downgrades, and attribute daemon/tray jobs to
Probo Agent.app via AssociatedBundleIdentifiers.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/deviceagent/update/update.go

@@ -325,6 +325,10 @@ func (u *Updater) Apply(ctx context.Context, rel *Release) error {
 		return fmt.Errorf("cannot extract archive: %w", err)
 	}
 
+	if err := ensureSignatureCompatible(ctx, u.Logger, u.ExePath, extractedBinary); err != nil {
+		return fmt.Errorf("cannot verify code signature compatibility: %w", err)
+	}
+
 	if err := replaceBinary(u.ExePath, extractedBinary); err != nil {
 		return fmt.Errorf("cannot replace agent binary: %w", err)
 	}