[Epic] Distribute fallout-agent via native package managers (winget, Homebrew, .deb)

[ChrisonSimtian]

Epic

Distribute the Fallout deployment agent (fallout-agent, from RFC #113) via the native package manager on each supported OS so operators get a signed, service-registered, upgrade-managed install — not a curl-piped tarball.

Why

RFC #113 nails the binary; this epic nails the install path. For a CD agent that runs as a daemon on operator-owned hosts, the package manager is the contract operators care about: signed provenance, native service registration, upgrade story, removal that actually removes. Three platforms in scope; each is a separate parent story.

Children

• As a Windows operator I can install fallout-agent via winget #121 — Windows / winget
• As a macOS operator I can install fallout-agent via Homebrew #122 — macOS / Homebrew
• As a Linux operator I can install fallout-agent via apt #123 — Linux / .deb

Cross-cutting concerns (deferred — track via comments here, not new stories yet)

• Versioning policy. Does the package-manager-published version always match Nerdbank.GitVersioning's MajorMinorPatchVersion, or do we strip prerelease tags for stable channels only?
• Pre-release channels. winget supports preview manifests, Homebrew taps can have --HEAD, .deb repos can have separate unstable suites. Out of scope until stable channels are shipping.
• Cert / key custody. Authenticode cert (Build signed MSIX installer for fallout-agent #125), Apple Developer ID + notarytool credentials (Codesign and notarize fallout-agent macOS binary #131), and project GPG key (GPG-sign .deb packages and publish key fingerprint #136) each need a documented rotation + custody plan. Likely one tracking issue once the rotation pattern is clear, not three.
• Recurring cost. Authenticode cert (~$200/yr+), Apple Developer Program ($99/yr), and any paid APT hosting (Cloudsmith etc.) add a non-trivial bill. Worth surfacing before sign-off.

Related

• RFC [RFC] CD deployment agent/runner — lightweight, forge-agnostic, idle-and-wait #113 — CD deployment agent/runner
• RFC [RFC] Continuous Delivery: Fallout as a release-management platform #106 — Continuous Delivery vision