fix: complete S0 device control lifecycle

[ToddHebebrand]

Summary

• add tolerant non-sticky agent control capabilities and deterministic peripheral policy v2 resolution
• persist and reconcile desired peripheral state with atomic agent enforcement and legacy-clear handling
• add authorized, resource-bound MFA-gated signed N-to-N-1 rollback directives
• execute rollback through restart-safe agent state and ingest append-only durable phase observations
• preserve tenant RLS, cascade, export, and old-agent compatibility boundaries

Verification

• shared permissions: 2/2 passed
• focused API and governance: 274/274 passed
• real-Postgres integration: 30/30 passed plus RLS coverage 75/75
• focused and full Go race suites passed
• Windows amd64, Linux amd64, and macOS arm64 cross-builds passed
• API typecheck, lint, migration naming, and diff hygiene passed
• broad API baseline: 25,341 passed, 22 skipped; exit 1 only from two documented pre-existing streamingUpload Undici unhandled rejections

Evidence boundaries

• RMM-QA-333 remains code-complete / fixed-unverified pending exact-candidate real peripheral enforcement evidence
• RMM-QA-225 remains code-complete / fixed-unverified pending exact signed Windows, macOS, and Linux restart/interruption evidence
• no production deployment, hosted-admission change, /opt/breeze modification, or customer-device mutation was performed

Review boundary

The program single independent Track D boundary review was consumed once. Its findings were fixed with targeted verification; no repeated reviewer loop was performed.

[cloudflare-workers-and-pages]

Deploying breeze with    Cloudflare Pages

Latest commit:	99e38f4
Status:	✅  Deploy successful!
Preview URL:	https://1a41cb8c.breeze-9te.pages.dev
Branch Preview URL:	https://fix-s0-device-control-lifecy.breeze-9te.pages.dev

View logs