feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

agent/deploy/registry_allowlist.go

@@ -0,0 +1,40 @@
+package deploy
+
+import (
+	"fmt"
+	"strings"
+)
+
+var allowedRegistryPathPrefixes = []string{
+	`software\`,
+	`environment`,
+}
+
+// ParseRegistryHive maps operator hive strings to internal tokens (hkcu/hklm).
+func ParseRegistryHive(hive string) (string, error) {
+	switch strings.ToUpper(strings.TrimSpace(hive)) {
+	case "HKCU", "HKEY_CURRENT_USER", "CURRENT_USER":
+		return "hkcu", nil
+	case "HKLM", "HKEY_LOCAL_MACHINE", "LOCAL_MACHINE":
+		return "hklm", nil
+	default:
+		return "", fmt.Errorf("unsupported hive %q (use HKCU or HKLM)", hive)
+	}
+}
+
+// ValidateRegistryPath ensures fleet registry ops stay under safe prefixes.
+func ValidateRegistryPath(hiveToken, subkey string) error {
+	subkey = strings.TrimSpace(subkey)
+	subkey = strings.TrimPrefix(subkey, `\`)
+	subkey = strings.TrimSuffix(subkey, `\`)
+	if subkey == "" {
+		return fmt.Errorf("registry path is required")
+	}
+	lower := strings.ToLower(subkey)
+	for _, prefix := range allowedRegistryPathPrefixes {
+		if strings.HasPrefix(lower, prefix) {
+			return nil
+		}
+	}
+	return fmt.Errorf("registry path %q is outside the allowed prefix list (Software\\, Environment)", subkey)
+}