feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

agent/client/registry_ops_stub.go

@@ -0,0 +1,13 @@
+//go:build !windows
+
+package client
+
+func (c *AgentClient) handleRegistryCommand(action, path, data string) bool {
+	switch action {
+	case "registry_read", "registry_write", "registry_delete":
+		c.sendCommandResult(action, false, "registry operations are unsupported on this platform")
+		return true
+	default:
+		return false
+	}
+}