feat: Agent distribution with secure enrollment from the control panel

One universal Windows Agent package per version (agent_releases: version/
platform/architecture/sha256/status DRAFT|PUBLISHED|REVOKED; the binary
lives on a local release-storage volume, never in PostgreSQL). An operator
creates a pending installation (agent_enrollments) from Agents / Servidores
-> + Nova instalação, then either downloads it directly or generates a
one-time HTTPS link (short TTL, single use). Either path streams the
package plus a freshly minted enrollment.json whose token is never written
to storage in plaintext, only its SHA-256 hash. On the client host,
gti-agent.ps1 install-auto verifies the bundle's SHA-256, refuses a non-
HTTPS Hub, enrolls via POST /v1/agents/enroll (deleting the enrollment
token immediately after, success or failure), writes an ACL-restricted
.env with the newly issued permanent Agent token, and registers the
Windows Service without starting it (Firebird stays unconfigured on
purpose). Idempotent, replay-proof, rate-limited per IP, fully audited,
never logs a secret.

Migration 0022_agent_releases_enrollment (verified fresh-DB ==
upgrade-from-0021 by pg_dump diff). GTI_FISCAL_VERSION/AGENT_VERSION
bumped to 1.1.0 as the single source of truth across code, packages, the
release manifest and every published AgentRelease row.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

release/RELEASE_MANIFEST.json

@@ -1,14 +1,14 @@
 {
  "artifact": "RELEASE_MANIFEST",
- "GTI_FISCAL_VERSION": "1.0.0-rc1",
- "generated_at": "2026-09-20T21:16:46+00:00",
+ "GTI_FISCAL_VERSION": "1.1.0",
+ "generated_at": "2026-09-23T16:10:58+00:00",
  "hub": {
-  "version": "1.0.0-rc1",
+  "version": "1.1.0",
   "api_compat": "1.0",
   "engine_version": "0.3.0",
   "decision_version": "mission-04c-ipi-ex-split"
  },
- "agent_version": "1.0.0-rc1",
+ "agent_version": "1.1.0",
  "fiscal_engine": {
   "ENGINE_VERSION": "0.3.0",
   "DECISION_VERSION": "mission-04c-ipi-ex-split",
@@ -17,10 +17,10 @@
   "ICMS_CONTEXT_ENGINE_VERSION": "icms-context-v1"
  },
  "migrations": {
-  "alembic_head_in_repo": "0021_sso_federated_identity",
-  "applied_revision": "0021_sso_federated_identity",
-  "applied_revision_source": "production Hub 10.0.10.117 (gti-fiscal-hub-fiscal-hub-1), verified 2026-09-23",
-  "count": 21
+  "alembic_head_in_repo": "0022_agent_releases_enrollment",
+  "applied_revision": "0022_agent_releases_enrollment",
+  "applied_revision_source": "container projeto-fiscal-hub-1",
+  "count": 22
  },
  "datasets_active": [
   {