v1.3.5

Fix agent TLS connection issues on macOS

This commit fixes critical bugs that prevented agents from connecting
to the control plane with TLS/mTLS enabled, particularly on macOS.

Changes:
- setup.sh: Fix launchd plist to use --server-ca instead of --ca-cert
- setup.sh: Add --insecure=false flag when TLS is enabled (was defaulting to true)
- setup.sh: Handle TLS-without-mTLS case in launchd plist generation
- setup.sh: Bump version to 1.3.5
- server: Fix /api/v1/ca-cert endpoint to serve Root CA instead of Intermediate CA

The agent requires the Root CA certificate to verify the server's identity,
not the Intermediate CA used for signing client certificates. The previous
logic incorrectly served the ClientCA (intermediate) instead of the Root CA.

Fixes connection errors: "error reading server preface: EOF" and
"failed to parse server CA certificate"