Install macOS helper from PKG for XPC enroll

Browser enrollment used osascript on every elevate. Ship a signed
privileged helper installed at PKG time so probo:// can enroll over
XPC with no second admin prompt. Add make install/uninstall/clean for
local PKG test loops, and show alerts only on failure.

Mirror the Go lint path for the macOS SPM package: Make
targets, root configs, and a Linux CI job. Keep checks
syntax-only so they do not need a macOS SDK. Format the
existing sources so the new gates start clean.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

cmd/probo-agent/installer/macos/Distribution.xml.tmpl

@@ -9,6 +9,7 @@
     @@PKG_ARCH@@      reserved (legacy; host filter uses @@HOST_ARCHS@@)
     @@HOST_ARCHS@@    host arch filter used by Installer.app
                       (e.g. arm64 or arm64,x86_64 for universal)
+    @@IDENTIFIER@@    package identifier (default com.probo.agent)
 -->
 <installer-gui-script minSpecVersion="2">
     <title>Probo Device Posture Agent @@VERSION@@</title>
@@ -38,20 +39,20 @@
     <license    file="license.txt"     mime-type="text/plain"/>
     <conclusion file="conclusion.html" mime-type="text/html"/>
 
-    <pkg-ref id="com.getprobo.agent"
+    <pkg-ref id="@@IDENTIFIER@@"
              version="@@VERSION@@"
              onConclusion="none">probo-agent-component.pkg</pkg-ref>
 
     <choices-outline>
         <line choice="default">
-            <line choice="com.getprobo.agent"/>
+            <line choice="@@IDENTIFIER@@"/>
         </line>
     </choices-outline>
 
     <choice id="default"/>
-    <choice id="com.getprobo.agent"
+    <choice id="@@IDENTIFIER@@"
             title="Probo Device Posture Agent"
             description="Installs probo-agent, the menu bar helper LaunchAgent, and Probo Agent.app for probo:// enrollment. The LaunchDaemon starts after enrollment.">
-        <pkg-ref id="com.getprobo.agent"/>
+        <pkg-ref id="@@IDENTIFIER@@"/>
     </choice>
 </installer-gui-script>