Distribution & install tooling for shellwatch-agent thin client

[rado0x54]

Context

Follow-up to #22 (SSH agent socket). Once the server-side WebSocket proxy and Go thin client are implemented, this issue covers everything needed to ship the thin client to users across platforms.

Scope

Cross-platform distribution

• goreleaser configuration for multi-platform builds (darwin/amd64, darwin/arm64, linux/amd64, linux/arm64, linux/arm, windows/amd64, freebsd/amd64)
• GitHub Actions release workflow (build on tag push, attach binaries + checksums)
• Homebrew tap (brew install shellwatch/tap/shellwatch-agent)
• Install script (curl -fsSL ... | sh) with OS/arch auto-detection

Auto-start services

• shellwatch-agent install-service / uninstall-service CLI commands
• macOS: ~/Library/LaunchAgents/com.shellwatch.agent.plist
• Linux: ~/.config/systemd/user/shellwatch-agent.service

Optional: local agent socket (server-side)

• For collocated deployments (ShellWatch + SSH client on same machine)
• net.createServer() on Unix domain socket inside ShellWatch
• Config: agentSocket.localSocket.enabled + socketPath
• Lower priority than the remote proxy path

Future system packages

• .deb for Debian/Ubuntu (via goreleaser nfpm)
• .rpm for Fedora/RHEL
• AUR for Arch

Windows named pipe support

• OpenSSH for Windows uses \\.\pipe\openssh-ssh-agent
• Go thin client may need --windows-pipe mode alongside AF_UNIX

[rado0x54]

Homebrew tap progress (paused on upstream public-repo gate).

• Created public tap repo: https://github.com/rado0x54/homebrew-tap
• Initial shellwatch-agent formula committed (targets agent/v0.0.1); passes brew audit clean.
• Service block included, so brew services start shellwatch-agent works once installed; relies on the credstore from Extend OAuth shim to issue agent-scoped keys (replace API-key paste in shellwatch-agent) #171 (no plist secret).
• brew install rado0x54/tap/shellwatch-agent will 404 today because the release binaries live in this private repo — anonymous HTTP can't fetch them. Documented in the formula header + tap README.

Next steps once rado0x54/ShellWatch goes public (gated by #147):

1. Re-run brew install rado0x54/tap/shellwatch-agent end-to-end against agent/v0.0.1.
2. Add the formula-bump step to .github/workflows/agent-release.yml (compute fresh sha256s, push to the tap repo) so future agent tags ship a Homebrew bump automatically. Mirrors the existing CHANGELOG-PR pattern; needs a PAT secret for cross-repo write.

Other items from the original scope (curl … | sh installer, install-service CLI, .deb/.rpm) are still open.

[rado0x54]

Windows-specific work split out to #175 so this issue can stay focused on distribution channels (Homebrew tap, install script, .deb/.rpm). The four-target build matrix in agent-release.yml (linux/{amd64,arm64}, darwin/{amd64,arm64}) covers everything Homebrew reaches plus most Linux server cases; Windows comes back into scope once the named-pipe listener from #175 lands.