Install macOS helper from PKG for XPC enroll

Browser enrollment used osascript on every elevate. Ship a signed
privileged helper installed at PKG time so probo:// can enroll over
XPC with no second admin prompt. Add make install/uninstall/clean for
local PKG test loops, and show alerts only on failure.

Mirror the Go lint path for the macOS SPM package: Make
targets, root configs, and a Linux CI job. Keep checks
syntax-only so they do not need a macOS SDK. Format the
existing sources so the new gates start clean.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

cmd/probo-agent/installer/macos/reinstall.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+#
+# Tear down any previous macOS install, then install a signed .pkg.
+# Must run as root. Used by: make -C cmd/probo-agent install
+#
+# Usage: reinstall.sh /path/to/probo-agent_*.pkg
+
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PKG="${1:-}"
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo "error: must run as root (try: sudo make -C cmd/probo-agent install)" >&2
+    exit 1
+fi
+
+if [ -z "${PKG}" ] || [ ! -f "${PKG}" ]; then
+    echo "error: usage: $0 /path/to/probo-agent_*.pkg" >&2
+    exit 2
+fi
+
+"${SCRIPT_DIR}/uninstall.sh"
+echo "Installing ${PKG}…"
+installer -pkg "${PKG}" -target /
+echo "PKG install complete."