Install macOS helper from PKG for XPC enroll

Browser enrollment used osascript on every elevate. Ship a signed
privileged helper installed at PKG time so probo:// can enroll over
XPC with no second admin prompt. Add make install/uninstall/clean for
local PKG test loops, and show alerts only on failure.

Mirror the Go lint path for the macOS SPM package: Make
targets, root configs, and a Linux CI job. Keep checks
syntax-only so they do not need a macOS SDK. Format the
existing sources so the new gates start clean.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

cmd/probo-agent/installer/macos/scripts/preinstall

@@ -12,6 +12,9 @@ LOG_FILE="/var/log/probo-agent-install.log"
 TRAY_LABEL="com.probo.agent.tray"
 TRAY_PLIST="/Library/LaunchAgents/${TRAY_LABEL}.plist"
 DAEMON_PLIST="/Library/LaunchDaemons/com.probo.agent.plist"
+HELPER_LABEL="com.probo.agent.helper"
+HELPER_PLIST="/Library/LaunchDaemons/${HELPER_LABEL}.plist"
+HELPER_BINARY="/Library/PrivilegedHelperTools/${HELPER_LABEL}"
 
 mkdir -p "$(dirname "${LOG_FILE}")"
 exec > >(tee -a "${LOG_FILE}") 2>&1
@@ -54,6 +57,17 @@ if [ -f "${DAEMON_PLIST}" ]; then
     echo "Booted out LaunchDaemon at ${DAEMON_PLIST}."
 fi
 
+if [ -f "${HELPER_PLIST}" ]; then
+    launchctl bootout system "${HELPER_PLIST}" 2>/dev/null || true
+    rm -f "${HELPER_PLIST}"
+    echo "Removed privileged helper LaunchDaemon at ${HELPER_PLIST}."
+fi
+
+if [ -f "${HELPER_BINARY}" ]; then
+    rm -f "${HELPER_BINARY}"
+    echo "Removed privileged helper binary at ${HELPER_BINARY}."
+fi
+
 if [ -f "${TRAY_PLIST}" ]; then
     echo "Existing tray LaunchAgent will be replaced by postinstall."
 fi