Install macOS helper from PKG for XPC enroll

Browser enrollment used osascript on every elevate. Ship a signed
privileged helper installed at PKG time so probo:// can enroll over
XPC with no second admin prompt. Add make install/uninstall/clean for
local PKG test loops, and show alerts only on failure.

Mirror the Go lint path for the macOS SPM package: Make
targets, root configs, and a Linux CI job. Keep checks
syntax-only so they do not need a macOS SDK. Format the
existing sources so the new gates start clean.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

cmd/probo-agent/installer/macos/enroll-ui/Info.plist.tmpl

@@ -6,7 +6,8 @@
 
   Placeholders are substituted by build-app.sh:
 
-    @@VERSION@@   agent version, e.g. 0.1.0
+    @@VERSION@@                        agent version, e.g. 0.1.0
+    @@HELPER_DESIGNATED_REQUIREMENT@@  codesign requirement for embedded helper
 -->
 <plist version="1.0">
 <dict>
@@ -15,7 +16,7 @@
     <key>CFBundleExecutable</key>
     <string>probo-agent-url-handler</string>
     <key>CFBundleIdentifier</key>
-    <string>com.getprobo.agent.url-handler</string>
+    <string>com.probo.agent.url-handler</string>
     <key>CFBundleName</key>
     <string>Probo Agent</string>
     <key>CFBundleDisplayName</key>
@@ -41,5 +42,10 @@
             </array>
         </dict>
     </array>
+    <key>SMPrivilegedExecutables</key>
+    <dict>
+        <key>com.probo.agent.helper</key>
+        <string>@@HELPER_DESIGNATED_REQUIREMENT@@</string>
+    </dict>
 </dict>
 </plist>