feat: add self-enrolling Windows Agent package

scripts/test-agent-transport-isolation.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+PROJECT="minerops-agent-transport-isolation-test-$$"
+
+compose=(
+  docker compose
+  --project-name "$PROJECT"
+  --env-file .env.dev
+  -f compose.dev.yaml
+)
+
+cleanup() {
+  "${compose[@]}" down \
+    --volumes \
+    --remove-orphans \
+    >/dev/null 2>&1 || true
+}
+
+trap cleanup EXIT
+
+echo "=== START DISPOSABLE POSTGRES ==="
+"${compose[@]}" up --detach postgres
+
+echo
+echo "=== WAIT FOR POSTGRES ==="
+
+ready=0
+
+for _ in $(seq 1 30); do
+  if "${compose[@]}" exec -T postgres \
+    sh -c 'pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB"' \
+    >/dev/null 2>&1
+  then
+    ready=1
+    break
+  fi
+
+  sleep 1
+done
+
+if [ "$ready" -ne 1 ]; then
+  echo "PostgreSQL did not become ready."
+  exit 1
+fi
+
+echo
+echo "=== BUILD BACKEND ==="
+"${compose[@]}" build backend
+
+echo
+echo "=== MIGRATE DATABASE ==="
+"${compose[@]}" run --rm backend \
+  alembic upgrade head
+
+echo
+echo "=== RUNTIME AGENT ZONE ISOLATION ==="
+"${compose[@]}" run --rm \
+  --volume "$PWD/backend/tests:/app/tests:ro" \
+  --env MINEROPS_TRANSPORT_ISOLATION_DISPOSABLE=1 \
+  backend \
+  python -m unittest -v \
+  tests.test_agent_transport_isolation_postgres
+
+echo
+echo "Runtime Agent transport Zone-isolation tests passed."

scripts/test-dev-baseline.sh

@@ -132,7 +132,7 @@ health_json="$(cat "${health_file}")"
 
 echo "Checking migrations and required schema..."
 current_revision="$("${compose[@]}" exec -T backend alembic current 2>/dev/null)"
-[[ "${current_revision}" == *"0016_agent_zones"* ]]
+[[ "${current_revision}" == *"0017_agent_enrollment"* ]]
 
 missing_tables="$(
     "${compose[@]}" exec -T postgres sh -c \

scripts/test-windows-agent-package.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${repo_root}"
+
+project_name="minerops-windows-package-test-$$"
+
+compose=(
+    docker compose
+    --project-name "${project_name}"
+    --env-file .env.dev
+    -f compose.dev.yaml
+)
+
+cleanup() {
+    status=$?
+    "${compose[@]}" down --volumes --remove-orphans \
+        >/dev/null 2>&1 || true
+    exit "${status}"
+}
+
+trap cleanup EXIT
+
+echo "=== BUILD BACKEND WITH CANONICAL AGENT SOURCE ==="
+"${compose[@]}" build backend
+
+echo
+echo "=== BACKEND PACKAGE TESTS ==="
+"${compose[@]}" run --rm --no-deps \
+    -v "${repo_root}/backend/tests:/app/tests:ro" \
+    backend python -m unittest -v \
+        tests.test_agent_windows_package
+
+echo
+echo "=== VERIFY CANONICAL SOURCE IS IN IMAGE ==="
+"${compose[@]}" run --rm --no-deps \
+    backend sh -ec '
+        test -f /app/agents/windows/Enroll-MinerOpsAgent.ps1
+        test -f /app/agents/windows/install.ps1
+        test -f /app/agents/windows/MinerOpsAgentService.ps1
+        test -f /app/agents/windows/VERSION
+    '
+
+echo
+echo "=== OFFICIAL POWERSHELL VALIDATION ==="
+docker run --rm \
+    -v "${repo_root}/agents/windows:/work:ro" \
+    mcr.microsoft.com/powershell:7.4-debian-12 \
+    pwsh -NoLogo -NoProfile -Command '
+        $ErrorActionPreference = "Stop"
+
+        foreach ($script in @(
+            "/work/Enroll-MinerOpsAgent.ps1",
+            "/work/install.ps1"
+        )) {
+            $tokens = $null
+            $errors = $null
+            [System.Management.Automation.Language.Parser]::ParseFile(
+                $script,
+                [ref]$tokens,
+                [ref]$errors
+            ) | Out-Null
+
+            if ($errors.Count -gt 0) {
+                throw "$script parser errors: $($errors.Message -join "; ")"
+            }
+
+            Write-Host "Parsed $script"
+        }
+
+        & /work/tests/Test-MinerOpsEnrollment.ps1
+        & /work/tests/Test-MinerOpsInstaller.ps1
+    '
+
+echo
+echo "Windows Agent package foundation tests passed."