Add Linux Fleet Node packaging and installer

[illegalprime]

Reviewable diff: +468/-0 across 7 files (excludes generated, test, and story files).

Summary

Adds installable Linux amd64 and arm64 Fleet Node releases with a checksum-verifying installer and hardened systemd unit. Stable and nightly publishing carry the Fleet Node archives, checksum sidecars, and installer from the artifact build into GitHub Releases, matching the installer's default download location.

How it works

The artifact workflow builds Fleet Node and its required plugins with CGO disabled on native amd64 and arm64 runners, then verifies the Go ELF binaries are statically linked. Each matrix run creates a versioned tarball and SHA-256 sidecar. Stable and nightly publishers download both architectures, verify that each checksum is bound to the expected filename, and publish the archives, sidecars, and installer as release assets.

An operator runs the installer with an explicit release version. The installer verifies that nmap is available, selects the host architecture, downloads and validates the matching archive, installs the program under /opt/fleetnode, creates protected config and state directories, and installs the unit under /etc/systemd/system. Existing active services are stopped for replacement and restarted afterward; fresh installations are explicitly disabled and remain stopped for enrollment.

flowchart LR
  A["Artifact workflow"] --> B["Build static Fleet Node and plugins"]
  B --> C["Versioned archives and checksums"]
  C --> D["Stable and nightly publishers"]
  D --> E["GitHub Release assets"]
  F["Installer with explicit version"] --> G["Verify nmap, archive, and checksum"]
  G --> E
  G --> H["Install fixed system paths"]
  H --> I["Install disabled systemd unit"]
  I --> J["Enroll, then enable service"]

Loading

Areas of the code involved

Area / package / file	What changed	Why it matters for review
.github/workflows/proto-fleet-artifact-build.yml	Adds amd64/arm64 CGO-disabled Fleet Node packaging and static-link checks	Review build inputs, architecture handling, archive layout, and checksum generation
.github/workflows/release.yml	Publishes and verifies stable Fleet Node assets	Ensures versioned installer URLs resolve for stable releases
.github/workflows/nightly-builds.yml	Publishes, verifies, repairs, and summarizes nightly Fleet Node assets	Ensures nightly versions remain installable and draft repair is complete
deployment-files/fleetnode/install-fleetnode.sh	Adds the Linux installer, nmap prerequisite, and upgrade behavior	Review privilege boundaries, validation, ownership, service state, and replacement behavior
deployment-files/fleetnode/fleetnode.service	Adds the native systemd service	Review execution paths, restart policy, and hardening directives
.github/workflows/deployment-config-checks.yml	Adds an installer-test job	Review the CI entry point and test isolation
.github/path-filters.yml	Routes Fleet Node deployment changes to deployment checks	Ensures installer-only changes run CI
deployment-files/fleetnode/tests/test-install-fleetnode.sh	Tests prerequisites, install, upgrade, state preservation, service handling, and checksum rejection	Test file

Key technical decisions & trade-offs

• Packages include Fleet Node and all required plugins rather than relying on host-installed plugin binaries.
• Go host binaries use CGO_ENABLED=0 and fail packaging if an ELF interpreter or shared-library dependency is present.
• nmap remains a host prerequisite instead of being copied from a runner-specific distribution into the archive.
• The installer requires an exact version instead of resolving latest, keeping archive and checksum selection deterministic.
• Stable and nightly publishers re-create each checksum sidecar before publishing, validating both digest and filename.
• Program files are replaced as a unit while /etc/fleetnode and /var/lib/fleetnode remain outside the replacement tree.
• Fresh installs reconcile stale systemd enablement and are not started; enrollment remains an explicit operator step.

Testing & validation

• Installer contract test covers missing nmap, stale service enablement, fresh installation, active-service upgrade, program replacement, config/state preservation, fixed systemd paths, and checksum rejection.
• Installer and test scripts pass bash -n.
• Modified workflow files parse as YAML.
• Repository-wide just lint passes.
• Fleet Node and Go plugins cross-build as static Linux amd64 and arm64 ELF binaries with CGO_ENABLED=0.
• Pre-commit and pre-push hooks pass.
• actionlint, shellcheck, and local readelf were unavailable; workflow static-link checks use readelf on Ubuntu runners, and local file inspection confirmed static ELF output.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cf88a9078d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e2bf384783

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cf1fbfa40e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".