Install macOS helper from PKG for XPC enroll

Browser enrollment used osascript on every elevate. Ship a signed
privileged helper installed at PKG time so probo:// can enroll over
XPC with no second admin prompt. Add make install/uninstall/clean for
local PKG test loops, and show alerts only on failure.

Mirror the Go lint path for the macOS SPM package: Make
targets, root configs, and a Linux CI job. Keep checks
syntax-only so they do not need a macOS SDK. Format the
existing sources so the new gates start clean.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

cmd/probo-agent/installer/macos/enroll-ui/HelperClient/EnrollmentFlow.swift

@@ -0,0 +1,43 @@
+import Foundation
+import ProboAgentShared
+
+public struct EnrollPreflightResult: Decodable {
+    public let server: String
+    public let token: String
+    public let alreadyEnrolled: Bool
+    public let configDir: String
+}
+
+public enum EnrollmentFlow {
+    private static let agentExecutablePath = ProboAgentHelperConstants.agentExecutablePath
+
+    public static func runPreflight(rawURL: String) throws -> EnrollPreflightResult {
+        let process = Process()
+        process.executableURL = URL(fileURLWithPath: agentExecutablePath)
+        process.arguments = ["enroll-url", "--preflight", rawURL]
+
+        let output = Pipe()
+        process.standardOutput = output
+        process.standardError = output
+
+        try process.run()
+        let data = try output.fileHandleForReading.readToEnd() ?? Data()
+        process.waitUntilExit()
+
+        guard process.terminationStatus == 0 else {
+            let message = String(data: data, encoding: .utf8)?
+                .trimmingCharacters(in: .whitespacesAndNewlines)
+            throw HelperClientError.operationFailed(process.terminationStatus, message)
+        }
+
+        return try JSONDecoder().decode(EnrollPreflightResult.self, from: data)
+    }
+
+    public static func installViaHelper(preflight: EnrollPreflightResult) throws {
+        try HelperClient.shared.install(
+            serverURL: preflight.server,
+            enrollmentToken: preflight.token,
+            configDir: preflight.configDir
+        )
+    }
+}