feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

agent/deploy/tunnel_ssh_stub.go

@@ -0,0 +1,9 @@
+//go:build !windows
+
+package deploy
+
+import "fmt"
+
+func StartSSHForward(_ SSHForwardMeta) (string, error) {
+	return "", fmt.Errorf("ssh forward is Windows-only in this build")
+}