v0.5.0: Fleet-analytics tools

Fleet-analytics release. Adds 28 derived/aggregation tools that iterate the fleet to answer questions the raw SimpleMDM API can't in a single call. All new tools are read-only and idempotent. No breaking changes.

Highlights

• 28 new fleet-analytics tools across four maturity tiers — top installed apps, app coverage, compliance violators, stale devices, storage health, OS eligibility, certificate expiration audit, and more. Full per-tool reference in docs/aggregation-tools-roadmap.md.
• 4 new resources under simplemdm://reports/: top-apps, unmanaged-apps, stale-devices, storage-health.
• 3 new prompts: app-inventory-audit, compliance-violators-remediation, profile-coverage-remediation.
• 3 new env knobs: SIMPLEMDM_FLEET_CONCURRENCY (worker pool, default 8), MAC_OS_ELIGIBILITY_OVERRIDE (model→max-OS table patches), CURRENT_SUPPORTED_OS_OVERRIDE (compliance baseline).
• get_compliance_violators baseline pinned to a stable per-platform supported-major (defaults macOS 15 / iOS 18 / iPadOS 18) instead of the fleet's highest observed OS, so a single beta device cannot skew the result. Devices past Apple's support window now labeled os_unsupported (filterable) instead of a numeric N_majors_behind.
• Tool count: 125 → 153.

Notes

Several tools depend on optionally-populated SimpleMDM fields (install_status, battery_cycle_count, last_used_at on enrollments, current_carrier_network, default_assignment_profile_uuid on dep_servers). They degrade gracefully (return empty) when the upstream field isn't there for your tenant — see the sparse-fields table in docs/aggregation-tools-roadmap.md.

Two tools were drafted but not shipped after senior-dev review: get_filevault_recovery_key_audit (no verified read endpoint in standard SimpleMDM API) and get_kernel_extension_inventory (MDM API doesn't expose KEXTs; requires a MunkiReport hardware module not in this codebase). Re-attempt paths documented in the roadmap doc.

Full changelog

See CHANGELOG.md for the complete list.