feat: Agent distribution with secure enrollment from the control panel

One universal Windows Agent package per version (agent_releases: version/
platform/architecture/sha256/status DRAFT|PUBLISHED|REVOKED; the binary
lives on a local release-storage volume, never in PostgreSQL). An operator
creates a pending installation (agent_enrollments) from Agents / Servidores
-> + Nova instalação, then either downloads it directly or generates a
one-time HTTPS link (short TTL, single use). Either path streams the
package plus a freshly minted enrollment.json whose token is never written
to storage in plaintext, only its SHA-256 hash. On the client host,
gti-agent.ps1 install-auto verifies the bundle's SHA-256, refuses a non-
HTTPS Hub, enrolls via POST /v1/agents/enroll (deleting the enrollment
token immediately after, success or failure), writes an ACL-restricted
.env with the newly issued permanent Agent token, and registers the
Windows Service without starting it (Firebird stays unconfigured on
purpose). Idempotent, replay-proof, rate-limited per IP, fully audited,
never logs a secret.

Migration 0022_agent_releases_enrollment (verified fresh-DB ==
upgrade-from-0021 by pg_dump diff). GTI_FISCAL_VERSION/AGENT_VERSION
bumped to 1.1.0 as the single source of truth across code, packages, the
release manifest and every published AgentRelease row.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/AI_PROJECT_STATE.md

@@ -1,5 +1,42 @@
 # AI Project State
 
+## Agent distribution + secure enrollment V1 (2026-09-23)
+
+`AGENT_DISTRIBUTION_V1_IMPLEMENTED` — the Windows Agent is now installable
+end to end from the control panel instead of a manual `register_agent.py` +
+hand-copied `.env`. One universal package per version
+(`agent_releases`: version/platform/architecture/sha256/status
+DRAFT|PUBLISHED|REVOKED, binary on a local `agent_releases` volume, never in
+PostgreSQL, published by `central/scripts/publish_agent_release.py`, never a
+browser upload). `Agents / Servidores -> + Nova instalação` creates a pending
+installation (`agent_enrollments`); its page offers an authenticated direct
+download or a one-time HTTPS link (`/dl/agent/{token}`, single use, short
+TTL). Either path streams the package plus a freshly minted `enrollment.json`
+— a one-time enrollment token whose plaintext is never written to storage,
+only its SHA-256 hash. On the client host, `gti-agent.ps1 install-auto`
+verifies the bundle's SHA-256 against `MANIFEST.json`, refuses a non-HTTPS
+Hub, calls `POST /v1/agents/enroll` (deletes `enrollment.json` immediately
+after either outcome), writes an ACL-restricted `.env` with the newly issued
+**permanent** Agent token, and registers the Windows Service without
+starting it (Firebird stays unconfigured on purpose — the operator fills it
+in, then `preflight`/`start`). Idempotent re-run, replay-proof (the
+enrollment token's hash is cleared on use), rate-limited per IP
+(`central/app/rate_limit.py`), fully audited
+(`INSTALLATION_CREATED`/`DOWNLOAD_LINK_CREATED`/`PACKAGE_DOWNLOADED`/
+`ENROLLMENT_SUCCEEDED`/`ENROLLMENT_REJECTED`/`AGENT_CREDENTIAL_ISSUED`/
+`INSTALLATION_REVOKED`, real IP, never a token). Migration
+`0022_agent_releases_enrollment`; verified fresh-DB == upgrade-from-0021
+(pg_dump identical) on both local dev and production Postgres. Real
+end-to-end proof ran over HTTP against the running Hub (not just
+TestClient): create -> link -> single-use download -> tamper/replay
+rejection -> enroll -> the minted Agent token authenticates
+`GET /v1/datasets/status`. `GTI_FISCAL_VERSION`/`AGENT_VERSION` bumped to
+`1.1.0` (single source of truth: `release/VERSION`, both `pyproject.toml`,
+`run_agent_service.py`'s default, the release manifest and every published
+`AgentRelease` row). See docs/PILOT_DEPLOYMENT.md, "Agent distribution:
+install from the panel". No real client Agent was installed by this pass
+— `FIRST_REAL_AGENT_INSTALLED=false`; the operator chooses the first pilot.
+
 ## Autonomous operations closure V1 (2026-09-22)
 
 `AUTONOMOUS_OPERATIONS_CLOSURE_VALIDATED` — the Agent now models per-product
@@ -440,7 +477,7 @@ allowlist and the fiscal rule engines still decide what may actually be written
 Hub `classification_cache` fixed: fingerprint (tenant + input + ENGINE_VERSION + dataset_versions()) is computed first and a HIT returns without running the Classifier (test: `central/tests/test_classification_cache.py`). Live benchmark (100 products): MISS 337 ms/product, HIT 15 ms/product, 100/100 hits, identical results. Fingerprint inputs unchanged, so existing cache entries stay valid and version bumps still invalidate naturally.
 
 ## Release Candidate 1.0.0-rc1 (2026-09-19) — COMPLETE_LOCAL_RC
-Frozen: `release/VERSION`, `central/app/version.py` (`GET /version`), `release/RELEASE_MANIFEST.json` (versions + ACTIVE dataset hashes + migrations; head `0021_sso_federated_identity` since 2026-09-23). See `docs/RELEASE_CANDIDATE_V1.md`.
+Frozen: `release/VERSION`, `central/app/version.py` (`GET /version`), `release/RELEASE_MANIFEST.json` (versions + ACTIVE dataset hashes + migrations; head `0022_agent_releases_enrollment` since 2026-09-23). See `docs/RELEASE_CANDIDATE_V1.md`.
 Architecture: Hub central (Docker Hub+PostgreSQL, `deploy/hub`) <-HTTPS- Agent Windows (`deploy/agent-windows`, service GTIFiscalAgent) -local read-only-> SGV Firebird. The Hub never accesses Firebird.
 Agent: `FISCAL_MODE` DRY_RUN|AUTO_APPLY (DRY_RUN = technically no writes), `COMPANY_CODE/COMPANY_CNPJ/COMPANY_CRT_SOURCE(AUTO|EMISSOR|C000004)`, `COMPANY_UF` explicit override only; single preflight `agent/scripts/preflight.py` (also enforced at service start); REPROCESS_ALL job result includes the coverage report + company context (`gti_fiscal_agent/coverage.py`, shared with multi-db tooling); `scripts/prove_zero_write.py` (DML counters + table digests). Packaging: `scripts/build_agent_package.py` (secret-scanned zip). Hub prod: `deploy/hub/docker-compose.prod.yml` (Postgres internal only), backup/restore, dataset seed export/import; `APP_ENV=production` refuses AGENT_DEV_TOKEN.
 Pilot profile: CONSTRUCAO (`pilot-construcao.env.example`); planned, not installed: MMMODAS/RINCAO/UNIAO with `COMPANY_CRT_SOURCE=EMISSOR`. No real host was accessed: a local simulation ran the Agent (registered agent, DRY_RUN) end-to-end on the CONSTRUCAO copy. Follow-up: memoize `dataset_versions()`.
@@ -487,7 +524,7 @@ See `docs/PRE_AI_LOCAL_COMPLETION_V3_REPORT.md` for measured values.
   collaborators in `admin_users` with `auth_source=GTI_GERENCIADOR`, no password);
   local admin only as break-glass at `/login/local`. Same visual identity as the
   panel (`static/gti-theme.css` is a copy of its design system).
-- Migration head: `0021_sso_federated_identity`. An empty database is initialized
+- Migration head: `0022_agent_releases_enrollment`. An empty database is initialized
   by `alembic upgrade head` alone — never `stamp`/`create_all`.
 - `0001` is a frozen explicit baseline (it used to call `create_all()`, which
   broke every fresh install). `0019` fixes the frozen `created_at` defaults