feat: default agentd clients to managed updates

[haasonsaas]

Summary

• Default new AgentConfig files to managed Chronicle mode with the chronicle.evalops.dev endpoint and the standard dev.evalops.agentd / chronicle Keychain bearer slot.
• Preserve explicit localOnly: true configs as local dev clients and keep encrypted local fallback enabled when managed config falls back locally.
• Embed the signed GitHub Sparkle appcast/public key in support/Info.plist, with automatic checks, signed-feed validation, and pre-extraction verification enabled by default.
• Update docs and tests for the managed-client and auto-update defaults.

Test Plan

• swift test --filter 'agentdTests.SubmitterTests/testAgentConfigDefaults|agentdTests.SparkleUpdaterConfigurationTests/testBundleInfoPlist'
• swift test
• xcrun swift-format lint --strict --recursive Sources Tests Package.swift
• python3 scripts/mock_chronicle.py --self-test Tests/Fixtures/chronicle
• swift build -Xswiftc -warnings-as-errors
• git diff --check
• scripts/package_app.sh
• /usr/libexec/PlistBuddy -c 'Print :SUFeedURL' -c 'Print :SUPublicEDKey' -c 'Print :SUEnableAutomaticChecks' -c 'Print :SUScheduledCheckInterval' -c 'Print :SURequireSignedFeed' -c 'Print :SUVerifyUpdateBeforeExtraction' 'dist/EvalOps agentd.app/Contents/Info.plist'

Notes

chronicle.evalops.dev currently resolves but returns Cloudflare 522; I filed evalops/deploy#2103 to wire the public managed origin through GitOps before new clients rely on the endpoint in production.

[cursor]

PR Summary

Medium Risk
Changes default runtime configuration to remote managed mode (endpoint, auth, encryption) and enables automatic Sparkle updates by default, which can affect connectivity and update behavior for new installs if misconfigured.

Overview
New installs now default to managed mode. AgentConfig decoding/fallback now assumes localOnly: false unless explicitly set, defaulting organizationId/endpoint to the managed Chronicle values and defaulting auth to Keychain-backed bearer auth; local-only configs still default to loopback + no auth.

Local fallback behavior is hardened. When forcing local-only after a submitter config rejection, the app now preserves the configured encryptLocalBatches setting rather than always disabling encryption.

Sparkle updates are enabled by default in packaged apps. support/Info.plist now embeds the GitHub appcast.xml feed URL + public key and turns on automatic checks + signed-feed/verification settings; docs/tests are updated to reflect these managed-update defaults.

^{Reviewed by Cursor Bugbot for commit 743417a. Bugbot is set up for automated code reviews on this repo. Configure here.}